app-attack-fixes/clickjacking-vulnerability

nginx.conf

@@ -1,24 +1,24 @@
-worker_processes 1;
-
-events {  }
-
-http {
-    include /etc/nginx/mime.types;
-
-    sendfile on;
-    server {
-        root /usr/share/nginx/html/;
-        index index.html;
-        listen 80;
-
-        add_header Content-Security-Policy "default-src https: 'unsafe-inline' 'unsafe-eval' blob: data: ws:" always;
-        # add_header Feature-Policy "microphone=(self),speaker=(self),fullscreen=(self),payment=(none);" always;
-        add_header Permissions-Policy "microphone=(self),speaker=(self),fullscreen=(self),payment=(none)" always;
-    }
-
-    gzip on;
-    gzip_types text/css application/javascript;
-    gzip_proxied any;
-    gzip_buffers 32 8k;
-
-}
+worker_processes 1;
+
+events {  }
+
+http {
+    include /etc/nginx/mime.types;
+
+    sendfile on;
+    server {
+        root /usr/share/nginx/html/;
+        index index.html;
+        listen 80;
+        # Commenting out Content-Security-Policy_headers here so that it won't create over-ride conflict with the security headers mentioned in proxy-nginx.conf
+        # add_header Content-Security-Policy "default-src https: 'unsafe-inline' 'unsafe-eval' blob: data: ws:" always;
+        # add_header Feature-Policy "microphone=(self),speaker=(self),fullscreen=(self),payment=(none);" always;
+        add_header Permissions-Policy "microphone=(self),speaker=(self),fullscreen=(self),payment=(none)" always;
+    }
+
+    gzip on;
+    gzip_types text/css application/javascript;
+    gzip_proxied any;
+    gzip_buffers 32 8k;
+
+}