enforce header security checks in nginx too

GrapheneOS · Sep 11, 2024 · bf99335 · bf99335
1 parent b04ba2b
commit bf99335
Showing 1 changed file with 36 additions and 0 deletions.
diff --git a/nginx/nginx.conf b/nginx/nginx.conf
@@ -292,6 +292,18 @@ http {
             if ($request_method != POST) {
                 return 405;
             }
+            if ($http_content_type != "application/json") {
+                return 403;
+            }
+            if ($http_sec_fetch_mode != "same-origin") {
+                return 403;
+            }
+            if ($http_sec_fetch_site != "same-origin") {
+                return 403;
+            }
+            if ($http_sec_fetch_dest != "empty") {
+                return 403;
+            }
             proxy_pass http://backend;
             limit_req zone=backend-limit burst=32 nodelay;
             limit_req zone=auth-limit burst=10 nodelay;
@@ -302,6 +314,18 @@ http {
             if ($request_method != POST) {
                 return 405;
             }
+            if ($http_content_type != "application/json") {
+                return 403;
+            }
+            if ($http_sec_fetch_mode != "same-origin") {
+                return 403;
+            }
+            if ($http_sec_fetch_site != "same-origin") {
+                return 403;
+            }
+            if ($http_sec_fetch_dest != "empty") {
+                return 403;
+            }
             proxy_pass http://backend;
             limit_req zone=backend-limit burst=32 nodelay;
             limit_req zone=auth-limit burst=10 nodelay;
@@ -312,6 +336,18 @@ http {
             if ($request_method != POST) {
                 return 405;
             }
+            if ($http_content_type != "application/json") {
+                return 403;
+            }
+            if ($http_sec_fetch_mode != "same-origin") {
+                return 403;
+            }
+            if ($http_sec_fetch_site != "same-origin") {
+                return 403;
+            }
+            if ($http_sec_fetch_dest != "empty") {
+                return 403;
+            }
             gzip on;
             gzip_min_length 256;
             gzip_types application/json;