-
Notifications
You must be signed in to change notification settings - Fork 5.5k
fix(docker): fix docker-compose startup failures for fresh installs #2422
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
base: main
Are you sure you want to change the base?
Changes from all commits
File filter
Filter by extension
Conversations
Jump to
Diff view
Diff view
There are no files selected for viewing
| Original file line number | Diff line number | Diff line change | ||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| @@ -0,0 +1,51 @@ | ||||||||||||||||||||||||
| server { | ||||||||||||||||||||||||
| listen 80; | ||||||||||||||||||||||||
| server_name localhost; | ||||||||||||||||||||||||
| root /usr/share/nginx/html; | ||||||||||||||||||||||||
| index index.html; | ||||||||||||||||||||||||
|
|
||||||||||||||||||||||||
| # Gzip compression | ||||||||||||||||||||||||
| gzip on; | ||||||||||||||||||||||||
| gzip_vary on; | ||||||||||||||||||||||||
| gzip_min_length 1024; | ||||||||||||||||||||||||
| gzip_proxied expired no-cache no-store private auth; | ||||||||||||||||||||||||
| gzip_types | ||||||||||||||||||||||||
| text/plain | ||||||||||||||||||||||||
| text/css | ||||||||||||||||||||||||
| text/xml | ||||||||||||||||||||||||
| text/javascript | ||||||||||||||||||||||||
| application/javascript | ||||||||||||||||||||||||
| application/xml+rss | ||||||||||||||||||||||||
| application/json; | ||||||||||||||||||||||||
|
|
||||||||||||||||||||||||
| # Security headers | ||||||||||||||||||||||||
| add_header X-Frame-Options "SAMEORIGIN" always; | ||||||||||||||||||||||||
| add_header X-XSS-Protection "1; mode=block" always; | ||||||||||||||||||||||||
| add_header X-Content-Type-Options "nosniff" always; | ||||||||||||||||||||||||
| add_header Referrer-Policy "no-referrer-when-downgrade" always; | ||||||||||||||||||||||||
| add_header Content-Security-Policy "default-src 'self' http: https: data: blob: 'unsafe-inline'" always; | ||||||||||||||||||||||||
|
Comment on lines
+21
to
+26
Contributor
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. 🚨 suggestion (security): X-XSS-Protection is deprecated and can be removed in favor of relying on CSP. Since most browsers now ignore this header and it can behave unpredictably in older ones, relying on your existing CSP is preferable and keeps the security configuration clearer and more accurate.
Suggested change
|
||||||||||||||||||||||||
|
|
||||||||||||||||||||||||
| # Handle client routing | ||||||||||||||||||||||||
| location / { | ||||||||||||||||||||||||
| try_files $uri $uri/ /index.html; | ||||||||||||||||||||||||
| } | ||||||||||||||||||||||||
|
|
||||||||||||||||||||||||
| # Cache static assets | ||||||||||||||||||||||||
| location ~* \.(js|css|png|jpg|jpeg|gif|ico|svg|woff|woff2|ttf|eot)$ { | ||||||||||||||||||||||||
| expires 1y; | ||||||||||||||||||||||||
| add_header Cache-Control "public, immutable"; | ||||||||||||||||||||||||
| } | ||||||||||||||||||||||||
|
|
||||||||||||||||||||||||
| # Cache HTML files for a shorter period | ||||||||||||||||||||||||
| location ~* \.html$ { | ||||||||||||||||||||||||
| expires 1h; | ||||||||||||||||||||||||
| add_header Cache-Control "public"; | ||||||||||||||||||||||||
| } | ||||||||||||||||||||||||
|
|
||||||||||||||||||||||||
| # Health check endpoint | ||||||||||||||||||||||||
| location /health { | ||||||||||||||||||||||||
| access_log off; | ||||||||||||||||||||||||
| return 200 "healthy\n"; | ||||||||||||||||||||||||
| add_header Content-Type text/plain; | ||||||||||||||||||||||||
| } | ||||||||||||||||||||||||
| } | ||||||||||||||||||||||||
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
🚨 issue (security): CSP includes
unsafe-inline, which largely defeats the protection CSP is meant to provide.In
default-src, this effectively disables CSP protections and leaves any injection point exploitable. Please tighten this by using nonces or hashes for required inline scripts/styles and removingunsafe-inline, or at minimum restrict it toscript-src/style-srcwith a documented justification.