# NginX Security HTTP Headers to Prevent Vulnerabilities

**URL:** <https://discourse.mailinabox.email/t/nginx-security-http-headers-to-prevent-vulnerabilities/9355>\
**Category:** Improvements\
**Created:** [July 31, 2022, 6:48pm UTC](https://discourse.mailinabox.email/t/nginx-security-http-headers-to-prevent-vulnerabilities/9355 "2022-07-31T18:48:50Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![box](https://discourse.mailinabox.email/letter_avatar_proxy/v4/letter/b/b19c9b/32.png) [@box](https://discourse.mailinabox.email/u/box)\
**Post date:** [July 31, 2022, 6:48pm UTC](https://discourse.mailinabox.email/t/nginx-security-http-headers-to-prevent-vulnerabilities/9355/1 "2022-07-31T18:48:50Z")

</div>

Looking at the following websites:

# The Mozilla Observatory

> **[HTTP Header Security Test - HTTP Observatory | MDN](https://developer.mozilla.org/en-US/observatory)**
>
> Test your site’s HTTP headers, including CSP and HSTS, to find security problems and get actionable recommendations to make your website more secure. Test other websites to see how you compare.

# HTTP Headers That Protect Your Users

> **[HTTP Headers That Protect Your Users](https://www.validbot.com/info/security-headers.php)**
>
> Discover the HTTP headers that your server should set in order to improve security and best protect your user's privacy.

# Hardening your HTTP response headers

> **[Hardening your HTTP response headers](https://scotthelme.co.uk/hardening-your-http-response-headers/)**
>
> Learn how to increase the security stance of your website by adding or removing some simple HTTP response headers.

That the following are advisable to be implemented:

## Content Security Policy (CSP)

#add\_header Content-Security-Policy “default-src https: data: ‘unsafe-inline’ ‘unsafe-eval’” always;  
add\_header Content-Security-Policy “default-src https:” always;

## HTTP Strict Transport Security (HSTS)

#add\_header Strict-Transport-Security “max-age=31536000; includeSubdomains” always;  
add\_header Strict-Transport-Security “max-age=31536000; includeSubDomains; preload;” always;

## HTTP Public Key Pinning

add\_header Public-Key-Pins “pin-sha256=‘X3pGTSOuJeEVw989IJ/cEtXUEmy52zs1TZQrU06KUKg=’; pin-sha256=‘MHJYVThihUrJcxW6wcqyOISTXIsInsdj3xK8QrZbHec=’; pin-sha256=‘isi41AizREkLvvft0IRW4u3XMFR2Yg7bvrF7padyCJg=’; includeSubdomains; max-age=2592000” always;

## X-Frame-Options

add\_header X-Frame-Options “SAMEORIGIN” always;

## X-Xss-Protection

#add\_header X-Xss-Protection “1; mode=block” always;  
add\_header X-XSS-Protection “0” always;

## X-Content-Type-Options

add\_header X-Content-Type-Options “nosniff” always;

## Removing “Server” Header

server {  
…  
server\_tokens off;  
}

## Referrer-Policy

add\_header Referrer-Policy “no-referrer” always;

## Permissions-Policy (Feature-Policy)

#add\_header Feature-Policy “camera ‘none’; microphone ‘none’; geolocation ‘none’” always;  
add\_header Permissions-Policy “camera=(), microphone=(), geolocation=()” always;

## Federated Learning of Cohorts (FLoC)

add\_header Permissions-Policy “interest-cohort=()” always;

## Expect-CT (SSL Certificate Transparency )

add\_header Expect-CT “max-age=86400, enforce, report-uri="[https://www.example.com/ct\_report\](https://www.example.com/ct_report%5C)”" always;

Would it be wise to have them implemented in the next MIAB release in NginX config file?

---

<div class="post-metadata">

**Author:** ![box](https://discourse.mailinabox.email/letter_avatar_proxy/v4/letter/b/b19c9b/32.png) [@box](https://discourse.mailinabox.email/u/box)\
**Post date:** [July 31, 2022, 9:16pm UTC](https://discourse.mailinabox.email/t/nginx-security-http-headers-to-prevent-vulnerabilities/9355/2 "2022-07-31T21:16:52Z")

</div>

I have tried adding on the above:

#Edit the Config  
sudo nano +32 /etc/nginx/nginx.conf

#Check the config  
sudo nginx -t

#Reload  
sudo systemctl reload nginx

But still scoring D on

> **[Analyse your HTTP response headers](https://securityheaders.com/)**
>
> Quickly and easily assess the security of your HTTP response headers

---

<div class="post-metadata">

**Author:** ![openletter](https://discourse.mailinabox.email/letter_avatar_proxy/v4/letter/o/f1d935/32.png) [@openletter](https://discourse.mailinabox.email/u/openletter)\
**Post date:** [August 1, 2022, 1:38am UTC](https://discourse.mailinabox.email/t/nginx-security-http-headers-to-prevent-vulnerabilities/9355/3 "2022-08-01T01:38:29Z")

</div>

The headers used change based on what is being requested.

I just use `curl` to check headers.

```
$ curl -I https://box.example.com

```

You can see different headers with `/admin`, `/mail/`, and `/cloud/index.php/login`.

---

<div class="post-metadata">

**Author:** ![box](https://discourse.mailinabox.email/letter_avatar_proxy/v4/letter/b/b19c9b/32.png) [@box](https://discourse.mailinabox.email/u/box)\
**Post date:** [August 1, 2022, 6:14am UTC](https://discourse.mailinabox.email/t/nginx-security-http-headers-to-prevent-vulnerabilities/9355/4 "2022-08-01T06:14:31Z")

</div>

Should the “headers” for WWW side be set to prevent HTTP Security Vulnerabilities for **all http** services?

---

<div class="post-metadata">

**Author:** ![system](https://discourse.mailinabox.email/uploads/default/original/2X/4/4d0933d13c456b7e57f296aa6cc344525b6f0c70.png) [@system](https://discourse.mailinabox.email/u/system)\
**Post date:** [September 30, 2022, 6:49pm UTC](https://discourse.mailinabox.email/t/nginx-security-http-headers-to-prevent-vulnerabilities/9355/5 "2022-09-30T18:49:35Z")

</div>

This topic was automatically closed after 61 days. New replies are no longer allowed.