#
# Security Headers
#

# Prevent IFRAME spoofing attacks
add_header X-Frame-Options           "SAMEORIGIN" always;

# Prevent MIME attacks
add_header X-Content-Type-Options    "nosniff" always;

# Prevent Referrer URL from being leaked
add_header Referrer-Policy           "no-referrer-when-downgrade" always;

# Configure Content Security Policy
# UPDATE - September 2020: Commenting this out until we grasp better security requirements
#add_header Content-Security-Policy   "default-src 'self' http: https: data: blob: 'unsafe-inline'" always;

# Enable HSTS
add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;

# Prevent access to . files (the well-known directory)
location ~ /\.(?!well-known) {
    deny all;
}