OpenLiteSpeed - Missing Security Headers

KrzysztofMaciejewski

How to add Security Headers to OLS?

Please scan any site with - https://securityheaders.com/

I think this is important.

JAY

yes looks need to add for all webserver.

KrzysztofMaciejewski

here is tutorial how to add headers in CyberPanel > https://forums.cyberpanel.net/discussion/88/tutorial-how-to-add-additional-http-header#latest

but we have disabled configuration in AApanel

@aaPanel_Jose can You help?

aaPanel_Jose

KrzysztofMaciejewski

context / {

  extraHeaders            <<<END_extraHeaders
  
X-Frame-Options SAMEORIGIN
X-Content-Type-Options nosniff
Content-Security-Policy "upgrade-insecure-requests;connect-src *"

  END_extraHeaders
}

Other headers you want to add can be added above the END_extraHeaders parameter

KrzysztofMaciejewski

Thanks for reply.

Can i add this headers to "default.conf" and all future domains will heave this security headers?

aaPanel_Jose

KrzysztofMaciejewski
It seems that you need to set up each site, I did not find this configuration on the ols official website

KrzysztofMaciejewski

thanks - me too - global settings not exist for this 🙁

if anybody wants i prepered good sample of security headers:

`context / {

extraHeaders <<<END_extraHeaders

Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Security-Policy "upgrade-insecure-requests;connect-src *"
Referrer-Policy strict-origin-when-cross-origin
X-Frame-Options: SAMEORIGIN
X-Content-Type-Options: nosniff
X-XSS-Protection 1;mode=block

END_extraHeaders
}`

carlita

KrzysztofMaciejewski allow me to update your code.

context / {

extraHeaders <<<END_extraHeaders

Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Security-Policy: default-src https:
X-Content-Type-Options "nosniff" always
X-Frame-Options: SAMEORIGIN
Referrer-Policy: no-referrer-when-downgrade
Permissions-Policy: geolocation=(self ""),

END_extraHeaders
}

And thanks both for the help 😀

KrzysztofMaciejewski

carlita whats the difference ?

carlita

KrzysztofMaciejewski Well now that I look at it not much LOL, sorry, but when I tried it at there was one missing. But could´ve been a cache issue, not sure.

luckybhumkar

Alternatively, you can add security headers as shown in the below screenshot.

KrzysztofMaciejewski

luckybhumkar THANKS!

Vevioz

A+ Rules:

Strict-Transport-Security: max-age=31536000; includeSubDomains Content-Security-Policy "upgrade-insecure-requests"; X-Content-Type-Options "nosniff" always X-Frame-Options: SAMEORIGIN Referrer-Policy: no-referrer-when-downgrade Permissions-Policy "interest-cohort=()" always;

Result:
https://securityheaders.com/?q=www.vevioz.com&followRedirects=on

Web: https://www.vevioz.com

aaP_imhd3d

Why do I have to referrer policies? https://www.warezbook.org

vinaypatel

I tried but it doesn't work - anything change since ?