diff --git a/install_nextcloud.sh b/install_nextcloud.sh index 762500b..79c1f21 100755 --- a/install_nextcloud.sh +++ b/install_nextcloud.sh @@ -1851,7 +1851,7 @@ EOF ProxyPassReverse /hosting/capabilities https://127.0.0.1:9980/hosting/capabilities # Main websocket - ProxyPassMatch "/cool/(.*)/ws$" wss://127.0.0.1:9980/cool/$1/ws nocanon + ProxyPassMatch "/cool/(.*)/ws$" wss://127.0.0.1:9980/cool/\$1/ws nocanon # Admin Console websocket @@ -4611,6 +4611,211 @@ if $apache2_installed ; then Options FollowSymLinks MultiViews + # - X-Frame-Options + # - + # - See: https://scotthelme.co.uk/hardening-your-http-response-headers/#x-frame-options + # - + # - X-Frame-Options tells the browser whether you want to + # - allow your site to be framed or not. By preventing a + # - browser from framing your site you can defend against + # - attacks like clickjacking + # - + # - The X-Frame-Options header (RFC), or XFO header, protects your visitors + # - against clickjacking attacks. An attacker can load up an iframe on their + # - site and set your site as the source, it's quite easy: + # - + # - + # - + # - Using some crafty CSS they can hide your site in the background and create some + # - genuine looking overlays. When your visitors click on what they think is a harmless + # - link, they're actually clicking on links on your website in the background. That + # - might not seem so bad until we realise that the browser will execute those requests + # - in the context of the user, which could include them being logged in and authenticated + # - to your site! + # - + # - Troy Hunt has a great blog on 'Clickjack attack – the hidden threat right in front : + # - of you': + # - + # - http://www.troyhunt.com/2013/05/clickjack-attack-hidden-threat-right-in.html + # - + # - Valid values: + # - + # - DENY meaning your site can't be framed + # - + # - SAMEORIGIN which allows you to frame your own site + # - + # - ALLOW-FROM https://example.com/ which lets you specify + # - sites that are permitted to frame your own site. + # - + # - Note: + # - For Apache 2.2 use + # - Header always set X-Frame-Options "SAMEORIGIN" + # - + Header always append X-Frame-Options "SAMEORIGIN" + # - X-Xss-Protection + # - + # - See: https://scotthelme.co.uk/hardening-your-http-response-headers/#x-xss-protection + # - + # - X-XSS-Protection sets the configuration for the cross-site + # - scripting filters built into most browsers. The best + # - configuration is "X-XSS-Protection: 1; mode=block". + # - + # - This header is used to configure the built in reflective XSS protection found + # - in Internet Explorer, Chrome and Safari (Webkit). + # - + # - Valid settings for the header are: + # - + # - 0 which disables the protection, + # - + # - 1 which enables the protection + # - + # - 1; mode=block which tells the browser to block the response + # - if it detects an attack rather than sanitising + # - the script. + # - + Header always set X-Xss-Protection "1; mode=block" + + # - X-Content-Type-Options + # - + # - See: https://scotthelme.co.uk/hardening-your-http-response-headers/#x-content-type-options + # - + # - X-Content-Type-Options stops a browser from trying to MIME-sniff + # - the content type and forces it to stick with the declared + # - content-type. + # - + # - Nice and easy to configure, this header only has one valid value, nosniff. + # - It prevents Google Chrome and Internet Explorer from trying to mime-sniff + # - the content-type of a response away from the one being declared by the server. + # - It reduces exposure to drive-by downloads and the risks of user uploaded content + # - that, with clever naming, could be treated as a different content-type, like + # - an executable. + # - + # - The only valid value for this header is + # - + # - "X-Content-Type-Options: nosniff". + # - + Header always set X-Content-Type-Options "nosniff" + + # - Referrer-Policy + # - + # - See: https://scotthelme.co.uk/a-new-security-header-referrer-policy/ + # - https://www.w3.org/TR/referrer-policy/ + # - + # - Referrer Policy is a new header that allows a site to control how + # - much information the browser includes with navigations away from + # - a document and should be set by all sites. + # - + # - The HTTP referer (originally a misspelling of referrer[1]) is an HTTP header + # - field that identifies the address of the webpage (i.e. the URI or IRI) that + # - linked to the resource being requested. By checking the referrer, the new + # - webpage can see where the request originated. + # - + # - For a complete list and explanation of values, see urls above + # - + # - Example: "no-referrer-when-downgrade" + # - The browser will not send the referrer header when navigating + # - from HTTPS to HTTP, but will always send the full URL in the + # - referrer header when navigating from HTTP to any origin. It + # - doesn't matter whether the source and destination are the same + # - site or not, only the scheme. + # - + Header always set Referrer-Policy "no-referrer" + + # - Permissions-Policy + # - + # - see also: + # - https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Permissions-Policy + # - + # - Browser bieten einige Features und APIs, auf die wir Entwickler zugreifen können. + # - Das beinhaltet etwa Kamera und Mikrofon des Endgeräts. Mit einer Permissions Policy + # - können wir diese Funktionen für unsere Seite aktivieren, deaktivieren oder auf eine + # - Quelle begrenzen. Wenn ihr ein Feature abschaltet, können auch keine Dritten darauf + # - zugreifen, etwa per eingebettetem