From 6858c4d3da3f1f3555285bb464d8b209abdf25c1 Mon Sep 17 00:00:00 2001
From: Atharv Bhandare <atharvbhandare2001@gmail.com>
Date: Tue, 22 Apr 2025 00:07:22 +1000
Subject: [PATCH] Mentioning headers to prevent XSS attacks and not to load any
 <iframe> on to the page

---
 production/shared-files/proxy-nginx.conf | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/production/shared-files/proxy-nginx.conf b/production/shared-files/proxy-nginx.conf
index b5537ae6e..92f10ec36 100644
--- a/production/shared-files/proxy-nginx.conf
+++ b/production/shared-files/proxy-nginx.conf
@@ -31,6 +31,11 @@ http {
         ssl_certificate     /etc/nginx/cert.crt;
         ssl_certificate_key /etc/nginx/key.key;
 
+        # Security Headers to Prevent Clickjacking
+        add_header X-Frame-Options "DENY" always;
+        add_header Content-Security-Policy "default-src 'self'; frame-ancestors 'none';" always;
+        #Mentioning headers to prevent XSS attacks and not to load any <iframe> on to the page
+
         # All api requests go to rails server
         location /api {
           proxy_set_header        Host $host;