nginx-security-headers.conf

# Security headers for canedr.cirad.fr (D-CAS 2.0)
#
# Usage: copy this file to the server, e.g.
#   /etc/nginx/snippets/canedr-security-headers.conf
# then include it inside the server block serving the app:
#
#   server {
#       ...
#       include /etc/nginx/snippets/canedr-security-headers.conf;
#   }
#
# NGINX CAVEAT: add_header directives are inherited from the server block
# ONLY if a location block defines no add_header of its own. If a location
# adds headers (e.g. Cache-Control for /assets/), re-include this file
# inside that location too, otherwise these headers are silently dropped.
#
# After any change: nginx -t && systemctl reload nginx
# Verify in the browser devtools (Network tab) or with:
#   curl -sI https://canedr.cirad.fr/ | grep -iE 'content-security|x-content|referrer|permissions|strict-transport'

# Content-Security-Policy — only same-origin resources may load.
# - script-src 'self': blocks any injected inline <script> (XSS mitigation).
#   The JSON-LD block in index.html is type="application/ld+json" (not
#   executable) so it is unaffected.
# - style-src 'unsafe-inline': required, the app sets inline style=""
#   attributes (src/components/header.ts) and Tailwind utilities.
# - img-src data:: allows small inline data-URI images/SVG backgrounds.
add_header Content-Security-Policy "default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; font-src 'self'; connect-src 'self'; manifest-src 'self'; worker-src 'self'; object-src 'none'; frame-ancestors 'none'; base-uri 'self'; form-action 'self'" always;

# Forbid MIME-type sniffing (a file served as image can never run as script).
add_header X-Content-Type-Options "nosniff" always;

# Outbound links only receive the origin, never the full URL.
add_header Referrer-Policy "strict-origin-when-cross-origin" always;

# The app never uses these browser features; deny them outright.
add_header Permissions-Policy "geolocation=(), camera=(), microphone=()" always;

# Force HTTPS for 1 year. Only enable once HTTPS is confirmed working —
# browsers will refuse plain HTTP for the whole max-age period.
add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;