summaryrefslogtreecommitdiff
path: root/nginx/snippets
AgeCommit message (Collapse)Author
2022-08-25remove legacy Expect-CT headerDaniel Micay
2022-08-25Add "Origin-Agent-Cluster" headerRohan Kumar
Hint to browsers that we prefer per-origin process isolation. This disables certain unsafe features regarding cross-origin same-site resource sharing. https://web.dev/origin-agent-cluster/#limitations Specification link: https://html.spec.whatwg.org/multipage/origin.html#origin-keyed-agent-clusters This is just a hint to browsers. Depending on resource availability, they may or may not actually allocate a process. For this reason, it's not a robust security feature although it is preferable. This header needs to be active on all pages from an origin for it to work.
2022-05-03drop configuration for clearing legacy push cookieDaniel Micay
2022-04-18add gamepad and speaker-selection to permissions policyJune
Signed-off-by: June <zanthed@riseup.net>
2021-12-11rename push cookie for clarityDaniel Micay
2021-12-11add preload/push for main page phone imageDaniel Micay
2021-12-10disable legacy X-XSS-Protection featureDaniel Micay
2021-12-05use http2_push instead of http2_push_preloadDaniel Micay
This avoids needing to conditionally add nopush to each preloaded resource in the Link header. There's also no support for pushing JavaScript modules via http2_push_preload since nginx doesn't have support for rel=modulepreload.
2021-12-04avoid sending unnecessary push cookieDaniel Micay
2021-11-24disable idle-detection in Permissions-PolicyDaniel Micay
2021-06-08mark Expect-CT as largely obsoleteDaniel Micay
2021-04-18disable unused Clipboard API featuresDaniel Micay
2021-04-18disable unused hid (WebHID API) featureDaniel Micay
2021-04-18disable unused serial (Web Serial API) featureDaniel Micay
2021-04-18disable interest-cohort featureDaniel Micay
2021-03-26enforce strict Trusted Types without policiesDaniel Micay
2021-03-23explicitly set SameSite for preload session cookieDaniel Micay
2021-02-15use once per session preload / pushDaniel Micay
2021-02-15use a single Link header for preloadingDaniel Micay
2021-02-15add preload headers for core fontsDaniel Micay
2021-01-26drop support for obsolete Feature-Policy headerDaniel Micay
This has been replaced by Permissions-Policy.
2021-01-23temporarily disable Trusted Types for web-installDaniel Micay
This can be enabled again when the zip library supports it.
2021-01-05add foundation for WebUSB-based install pageDaniel Micay
2020-12-31document deprecated/obsolete headersDaniel Micay
2020-11-14move TLS configuration into nginx.confDaniel Micay
2020-10-27add require-trusted-types-for 'script' to CSPDaniel Micay
2020-10-27add COOP / COEP headersDaniel Micay
2020-10-03add Permissions-Policy headerDaniel Micay
2020-09-27disable unused publickey-credentials-get featureDaniel Micay
2020-09-27remove unused Feature-Policy speaker directiveDaniel Micay
2020-09-27handle Feature-Policy standard renaming wake-lockDaniel Micay
2020-09-27drop (unfortunately) obsolete HPKP supportDaniel Micay
2020-07-22drop usage of report-uri for Expect-CT and CSPDaniel Micay
This has proven to be unhelpful and we don't need this kind of reporting with the simplicity of the site and policies.
2020-04-19stop pinning IdenTrust root that's on the way outDaniel Micay
2020-04-07switch HPKP backup pinsDaniel Micay
2020-04-05certbot-ocsp-fetcher for reliable OCSP staplingDaniel Micay
2020-04-01move nginx https setup into a snippetDaniel Micay
2020-04-01remove obsolete HPKP report-uri URLDaniel Micay
2020-04-01add nginx configurationDaniel Micay
generated by cgit v1.3.1 (git 2.54.0) at 2026-09-05 13:14:12 +0000