... | ... | @@ -83,6 +83,8 @@ ErrorDocument 403 "Forbidden" |
|
|
|
|
|
It is really advided to use HTTPS and make HTTP redirect to it. Use Let's Encrypt to obtain free certificates.
|
|
|
|
|
|
Make sure the `X-FORWARDED-PROTO` header is passed so that Framadate knows that it needs to generate HTTPS urls.
|
|
|
|
|
|
#### Content Security Policy
|
|
|
|
|
|
If you have access to the configuration of your Framadate web server, it is [a good practice](https://wiki.mozilla.org/Security/Guidelines/Web_Security#Content_Security_Policy) to return a `Content-Security-Policy` header as it prevents different types of XSS attacks.
|
... | ... | @@ -124,10 +126,12 @@ Note that the path or name of the .htpasswd does not matter for nginx. put it ou |
|
|
|
|
|
### HTTPS
|
|
|
|
|
|
You can use LetsEncrypt to get certificates
|
|
|
You can use LetsEncrypt to get certificates.
|
|
|
|
|
|
https://certbot.eff.org/lets-encrypt/debianstretch-nginx
|
|
|
|
|
|
Make sure the `X-FORWARDED-PROTO` header is passed so that Framadate knows that it needs to generate HTTPS urls.
|
|
|
|
|
|
### A working example with HTTPS
|
|
|
|
|
|
```nginx
|
... | ... | |