Set additional html response headers

bnomei · September 23, 2017, 1:13pm

i just found the following tool and was wondering how to add html response headers to all requests served by kirby.

texnixe · September 23, 2017, 1:58pm

getkirby/getkirby.com/blob/master/site/config/config.getkirby.com.php

<?php

header('X-Frame-Options: SAMEORIGIN');
header('X-XSS-Protection: 1; mode=block');
header('X-Content-Type-Options: nosniff');
header('Content-Security-Policy: default-src https: \'unsafe-inline\' \'unsafe-eval\'');
header('strict-transport-security: max-age=31536000; includeSubdomains');

c::set('cdn.assets', 'https://assets.getkirby.com/assets');
c::set('cdn.content', 'https://assets.getkirby.com/content');
c::set('cdn.thumbs', 'https://assets.getkirby.com/thumbs');
c::set('cachebuster', true);

c::set('cache.cheatsheet', true);

bnomei · September 23, 2017, 7:40pm

ah. using the config file. thats a good solution. thanks @texnixe for providing a live example as well.

jimbobrjames · September 24, 2017, 8:48am

I use .htaccess rules based on the HTML5 boilerplate.

@texnixe Do these headers do anything different or compliment this?

texnixe · September 24, 2017, 9:09am

Yes, you can also set these headers via .htaccess/your server config file. If you set these headers in the config file, you can set different options for different environments.

bnomei · October 4, 2017, 3:31pm

referrer policy could be set as well. but please read which value you need. following is just an example.

header('Referrer-Policy: no-referrer-when-downgrade');

bnomei · October 5, 2017, 8:04am

about Content Security Policy: using both unsafe inline and eval options for default-src seems a bit … well unsafe.

https://content-security-policy.com/#source_list

daybugging · February 7, 2018, 9:07am

What’s cache.cheatsheet doing?

S1SYPHOS · February 10, 2018, 10:51am

Kind of funny - it’s just an option Kirby’s site is using, eg in the Cheatsheet’s controller:

github.com

getkirby/getkirby.com/blob/master/site/controllers/cheatsheet.php

<?php

return function($site, $pages, $page) {

  if(c::get('cache.cheatsheet')) {
    $cache   = new Cache\Driver\File(kirby()->roots()->cache());
    $cacheId = sha1($page->id()) . '.main';
    $content = $cache->get($cacheId);    
  } else {
    $content = null;
  }

  if(empty($content)) {    
    $content = snippet('cheatsheet', array('page' => $page), true);
    if(c::get('cache.cheatsheet')) {
      $cache->set($cacheId, $content);
    }
  }

  return compact('content');

This file has been truncated. show original

Hopefully unraveling this mystery,
S1SYPHOS

texnixe · February 10, 2018, 11:01am

@daybugging Sorry, I completely overlooked your question, @S1SYPHOS thanks for your answer.

In fact, you can use any custom settings in your config file, for example, if you want to handle things differently on local and on your server, or if you want to set global variables. Options for your private plugins etc. etc.

Topic		Replies	Views
Kirby3 Security Headers - Best practice headers, Nonce, CSP and Feature Policies Kirby 3 plugin 🧩 plugin , security	1	946	April 13, 2022
CSP with Kirby - how to best generate a nonce? Questions 🤔	4	6118	January 4, 2018
Setting CORS headers Questions 🤔	3	107	February 6, 2024
Security: Check your RewriteBase settings Articles	14	4604	June 8, 2016
Https .htaccess Solved ✅	2	2070	January 22, 2021

Set additional html response headers

Related Topics