... | ... | @@ -31,6 +31,7 @@ The migration page handles: |
|
|
Advanced settings, like the SMTP credentials or the default poll duration, must be manually filled inside the file `app/inc/config.php` on the webserver.
|
|
|
|
|
|
## Apache
|
|
|
|
|
|
### Clean URL
|
|
|
To have fancy URLs, activate URL rewriting by activating the provided `.htaccess` file, by renaming it from `htaccess.txt` to `.htaccess`:
|
|
|
|
... | ... | @@ -104,17 +105,20 @@ If someone clicks on an external link inside a survey, the website that link poi |
|
|
|
|
|
|
|
|
## Nginx
|
|
|
|
|
|
|
|
|
### Secure server
|
|
|
#### Content Security Policy
|
|
|
```nginx
|
|
|
add_header Content-Security-Policy "default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval'; object-src 'none'; style-src 'self' 'unsafe-inline'; font-src 'self'; img-src 'self'";
|
|
|
```
|
|
|
|
|
|
|
|
|
### Nginx
|
|
|
#### Referrer-Policy
|
|
|
```nginx
|
|
|
add_header Referrer-Policy "strict-origin";
|
|
|
```
|
|
|
|
|
|
## Various headers
|
|
|
#### Various headers
|
|
|
|
|
|
In the same way that we added the `Content-Security-Policy` and `Referrer-Policy`, we can have :
|
|
|
* `X-Content-Type-Options: nosniff` to avoid XSS attacks through incorrect MIME types
|
... | ... | |