[英]add security headers in NGINX while using fastcgi caching
I am using nginx with fastcgi cache.我正在使用带有 fastcgi 缓存的 nginx。 I want to use security headers on my site.我想在我的网站上使用安全标头。 I have already added add header field in my virtual host configurations but I can not get any headers unless I disable add_header X-fastcgi cache $upstream cache status in my fastcgi_main.conf file.我已经在我的虚拟主机配置中添加了 add header 字段,但是除非我在 fastcgi_main.conf 文件中禁用 add_header X-fastcgi cache $upstream cache status,否则我无法获得任何标头。 virualhost file :虚拟主机文件:
}
include /etc/nginx/bots.d/blockbots.conf;
include /etc/nginx/bots.d/ddos.conf;
include /etc/nginx/skip_cache.conf ;
include /etc/nginx/purge_location.conf ;
include /etc/nginx/gzip_location.conf ;
include /etc/nginx/security_wp.conf;
add_header Referrer-Policy 'origin';
add_header "X-Frame-Options: sameorigin" always;
location ~ \.php$ {
include snippets/fastcgi-php.conf;
fastcgi_pass unix:/var/run/php/php7.3-fpm.sock;
include "/etc/nginx/customfastcgi" ;
proxy_connect_timeout 300;
proxy_send_timeout 300;
proxy_read_timeout 300;
send_timeout 300;
# underscores_in_headers on;
client_max_body_size 256M;
include /etc/nginx/fastcgi_main.conf ;
}
}
FASTCGI_main.conf FASTCGI_main.conf
fastcgi_no_cache $skip_cache;
fastcgi_cache phpcache;
fastcgi_cache_valid 200 1m;
fastcgi_cache_valid 301 1m;
fastcgi_cache_valid 302 1m;
fastcgi_cache_valid 307 1m;
fastcgi_cache_valid 404 1m;
fastcgi_cache_use_stale error timeout invalid_header http_500 http_503;
fastcgi_cache_min_uses 1;
fastcgi_cache_methods GET HEAD;
fastcgi_ignore_headers Cache-Control Expires Set-Cookie;
add_header X-FastCGI-Cache $upstream_cache_status;
```
RESULT:
curl -I https://dev-kuhicbury.$domain
HTTP/1.1 200 OK
Server: nginx/1.10.3 (Ubuntu)
Date: Fri, 09 Oct 2020 11:39:35 GMT
Content-Type: text/html; charset=UTF-8
Connection: keep-alive
Vary: Accept-Encoding
rel="https://api.w.org/"
X-FastCGI-Cache: HIT
You've stepped onto a very common configuration pitfall of the add_header
directive.您已经遇到了add_header
指令的一个非常常见的配置陷阱。 Similar to all other array-like directives in NGINX, it is only inherited, if there is no other add_header
in the current context.与 NGINX 中所有其他类似数组的指令类似,只有在当前上下文中没有其他add_header
才会继承它。
The typical solution is to copy-paste (through inevitable duplication), the desired headers in a specific location:典型的解决方案是在特定位置复制粘贴(通过不可避免的重复)所需的标题:
In FASTCGI_main.conf
:在FASTCGI_main.conf
:
fastcgi_no_cache $skip_cache;
fastcgi_cache phpcache;
fastcgi_cache_valid 200 1m;
fastcgi_cache_valid 301 1m;
fastcgi_cache_valid 302 1m;
fastcgi_cache_valid 307 1m;
fastcgi_cache_valid 404 1m;
fastcgi_cache_use_stale error timeout invalid_header http_500 http_503;
fastcgi_cache_min_uses 1;
fastcgi_cache_methods GET HEAD;
fastcgi_ignore_headers Cache-Control Expires Set-Cookie;
add_header X-FastCGI-Cache $upstream_cache_status;
add_header Referrer-Policy 'origin';
add_header "X-Frame-Options: sameorigin" always;
This unintuitive behavior of NGINX has been a source of trouble for many. NGINX 的这种不直观的行为给许多人带来了麻烦。
Here are some modules of interest, which address the same issue (as in, "better add_header
"):以下是一些感兴趣的模块,它们解决了相同的问题(如“更好的add_header
”):
声明:本站的技术帖子网页,遵循CC BY-SA 4.0协议,如果您需要转载,请注明本站网址或者原文地址。任何问题请咨询:yoyou2525@163.com.