tests sécurisation headers

Author: cdebarros

.docker/nginx.apps.conf

@@ -7,25 +7,27 @@ server {
 
         server_tokens off;
 
-        add_header X-Frame-Options "SAMEORIGIN";
-
         location ~ /index.html|.*\.toml|.*\.json$ {
           expires -1;
           add_header Cache-Control 'no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0';
+          add_header X-Frame-Options "SAMEORIGIN";
         }
 
         location ~ .*\.css$|.*\.js$ {
           add_header Cache-Control 'max-age=86400'; # 24h
+          add_header X-Frame-Options "SAMEORIGIN";
         }
 
         location ~ .*\.otf$|.*\.ttf$|.*\.woff2?$ {
           add_header Cache-Control 'max-age=31536000'; # 1year
+          add_header X-Frame-Options "SAMEORIGIN";
         }
 
         location / {
           try_files $uri $uri/ /index.html;
 
           add_header Cache-Control 'max-age=86400'; # 24h
+          add_header X-Frame-Options "SAMEORIGIN";
         }
 
         error_page   500 502 503 504  /50x.html;