bida/Mastodon-documentation
5
0
Fork 0
Code Issues Pull requests Releases Wiki Activity

Add info about already set HTTP headers

Browse source 
Intended to avoid setting duplicate HTTP headers which will cause issues with tools like Mozilla Observatory many people use to evaluate an instance's security.
This commit is contained in:
Lukas Burk 2017-04-13 19:37:33 +02:00 committed by GitHub
parent d960311faa
commit dae0d21d57
1 changed files with 9 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

9
Running-Mastodon/Production-guide.md
View file

@ -1,6 +1,15 @@
Production guide
================
The following HTTP readers are already set internally and should not be set again:
```
'Server' => 'Mastodon',
'X-Frame-Options' => 'DENY',
'X-Content-Type-Options' => 'nosniff',
'X-XSS-Protection'       => '1; mode=block',
```
## Nginx
Regardless of whether you go with the Docker approach or not, here is an example Nginx server configuration: