Improve web content delivery in Nginx by adding some headers by default like: X-Frame-Options, X-XSS-Protection and X-Content-Type-Options

roles/webserver/tasks/nginx.yml

@@ -29,6 +29,7 @@
     - expires
     - cache-fd
     - protect-files
+    - security
   notify:
     - Reload nginx
   when: with_nginx

roles/webserver/templates/nginx/vhost_all.j2

@@ -6,3 +6,4 @@
 include /etc/nginx/vhost_expires;
 include /etc/nginx/vhost_cache-fd;
 include /etc/nginx/vhost_protect-files;
+include /etc/nginx/vhost_security;

roles/webserver/templates/nginx/vhost_expires.j2

@@ -8,33 +8,37 @@
 
 # cache.appcache, your document html and data
 location ~* \.(?:manifest|appcache|html?|xml|json)$ {
-  expires -1;
+    expires -1;
 }
 
 # Feeds
 location ~* \.(?:rss|atom)$ {
-  expires 1h;
-  add_header Cache-Control "public";
+    expires 1h;
+    add_header Cache-Control "public";
+    add_header X-Content-Type-Options "nosniff";
 }
 
 # Media: images, icons, video, audio, HTC
 location ~* \.(?:jpg|jpeg|gif|png|ico|gz|svg|svgz|mp4|ogg|ogv|webm|htc)$ {
-  expires 1M;
-  access_log off;
-  add_header Cache-Control "public";
+    expires 1M;
+    access_log off;
+    add_header Cache-Control "public";
+    add_header X-Content-Type-Options "nosniff";
 }
 
 # Web fonts
-location ~* \.(?:ttf|ttc|otf|eot|woff)$ {
+location ~* \.(?:ttf|ttc|otf|eot|woff|woff2)$ {
     expires 1M;
     access_log off;
     add_header Cache-Control "public";
     add_header "Access-Control-Allow-Origin" "*";
+    add_header X-Content-Type-Options "nosniff";
 }
 
 # CSS and Javascript
 location ~* \.(?:css|js)$ {
-  expires 2M;
-  access_log off;
-  add_header Cache-Control "public";
+    expires 2M;
+    access_log off;
+    add_header Cache-Control "public";
+    add_header X-Content-Type-Options "nosniff";
 }

roles/webserver/templates/nginx/vhost_security.j2

@@ -0,0 +1,16 @@
+{% if ansible_prolog -%}
+{% from 'templates/ansible/prolog.j2' import prolog with context %}
+{{ prolog() }}
+{% endif -%}
+#
+# Various security rules
+#
+
+# Clickjacking protection
+add_header X-Frame-Options "sameorigin";
+
+# Cross-site scripting (XSS) filter
+add_header X-XSS-Protection "1; mode=block";
+
+# Prevents from MIME-sniffing a response away from the declared content-type
+add_header X-Content-Type-Options "nosniff";