From c4c07cbc16c105d41d101f4faa3c9e9916cb46c0 Mon Sep 17 00:00:00 2001 From: jzzliu Date: Sat, 7 Nov 2026 21:18:38 -0700 Subject: [PATCH] Add security and cache headers to the Caddy config Strict Content-Security-Policy (the site has no inline script or style), nosniff, referrer and permissions policies, no Server header, no-cache for HTML and five-minute caching for unfingerprinted assets. --- Caddyfile | 16 ++++++++++++++++ 1 file changed, 16 insertions(+) diff --git a/Caddyfile b/Caddyfile index 6bcb36a..7d16509 100644 --- a/Caddyfile +++ b/Caddyfile @@ -1,5 +1,21 @@ :8080 { root * /srv/fieldwork encode zstd gzip + + header { + # The site has no inline scripts or styles, so a strict policy costs nothing. + Content-Security-Policy "default-src 'self'; img-src 'self' data:; object-src 'none'; base-uri 'self'; form-action 'self'; frame-ancestors 'none'" + X-Content-Type-Options nosniff + Referrer-Policy strict-origin-when-cross-origin + Permissions-Policy "camera=(), microphone=(), geolocation=()" + -Server + } + + # Files are not fingerprinted, so keep asset caching short; HTML must always revalidate. + @assets path *.css *.js *.svg + header @assets Cache-Control "public, max-age=300" + @pages not path *.css *.js *.svg + header @pages Cache-Control "no-cache" + file_server }