Secure Nginx Config

secure.conf

add_header Strict-Transport-Security 'max-age=31536000; includeSubDomains; preload';
add_header Content-Security-Policy "default-src 'self'; font-src *;img-src * data:; script-src *; style-src *";
add_header X-XSS-Protection "1; mode=block";
add_header X-Frame-Options "SAMEORIGIN";
add_header X-Content-Type-Options nosniff;
add_header Referrer-Policy "strict-origin";
add_header Permissions-Policy "geolocation=(),midi=(),sync-xhr=(),microphone=(),camera=(),magnetometer=(),gyroscope=(),fullscreen=(self),payment=()";
add_header Access-Control-Allow-Origin 'https://<some full domain>';
add_header Access-Control-Allow-Methods 'GET, OPTIONS, HEAD, POST, PUT, DELETE';
add_header Access-Control-Allow-Headers 'Authorization, X-App-Token, X-Access-Token, Keep-Alive, User-Agent, X-Requested-With, If-Modified-Since, Cache-Control, Content-Type';

# Load this in nginx.conf
# Need to install nginx-extras
# sudo apt-get install nginx-extras

more_clear_headers Server;
server_tokens off;
proxy_hide_header X-Powered-By;

To use this config, create a new file secure.conf in /etc/nginx. Then include this file in each server block:

include /etc/nginx/secure.conf;