How to add custom HTTP headers
Add custom or security-related HTTP response headers to your application on TurboStack.
Add your own HTTP response headers - most often security headers - with a small piece of custom Nginx configuration.
Before you start
- SSH access to the host - see SSH access.
- Add the headers in
~/nginx/50main.conf- see custom Nginx configuration.
Add security headers
In the server block (or a location), use add_header with the always flag so the header is sent
on error responses too:
add_header X-Frame-Options "SAMEORIGIN" always;
add_header X-Content-Type-Options "nosniff" always;
add_header Referrer-Policy "strict-origin-when-cross-origin" always;Important
If you add add_header inside a location, Nginx stops inheriting the headers set higher up - you
must repeat the ones you still want in that location.
Restrict access to text and log files
A common hardening rule: allow robots.txt, but deny other .txt and .log files.
location = /robots.txt {
allow all;
log_not_found off;
access_log off;
}
location ~* \.(txt|log)$ {
deny all;
}Apply and verify
tscli nginx reloadCheck the headers with:
curl -I https://example.comTip
To make browsers always use HTTPS, add the Strict-Transport-Security (HSTS) header - but only
once HTTPS works everywhere, because it is hard to undo. See Force HTTPS.