Merge pull request #15470 from nextcloud/fix/hsts-static-assets

Add HSTS header to static assets

Author: szaimen

admin_manual/installation/nginx-root.conf.sample

@@ -225,6 +225,15 @@ server {
     # Serve static files
     location ~ \.(?:css|js|mjs|svg|gif|ico|jpg|png|webp|wasm|tflite|map|ogg|flac|mp4|webm)$ {
         try_files $uri /index.php$request_uri;
+	
+		# HSTS settings
+		# WARNING: Only add the preload option once you read about
+		# the consequences in https://hstspreload.org/. This option
+		# will add the domain to a hardcoded list that is shipped
+		# in all major browsers and getting removed from this list
+		# could take several months.
+		#add_header Strict-Transport-Security "max-age=31536000; includeSubDomains; preload" always;
+
         # HTTP response headers borrowed from Nextcloud `.htaccess`
         add_header Cache-Control                     "public, max-age=15778463$asset_immutable";
         add_header Referrer-Policy                   "no-referrer"       always;