Nginx http header module

[kilwir76]

Hello everyone, I cannot clear certain headers for security reasons such as the 'Server' direction.

Ideally with one of my custom dockerfile I download this under Alpine:

############################################
# Base Image
############################################
FROM serversideup/php:8.3-fpm-nginx-alpine as base

############################################
# Development Image
############################################
FROM base as development

# Switch to root so we can do root things
USER root

# Save the build arguments as a variable
ARG USER_ID
ARG GROUP_ID

# Setup unique user and group - needs bash
RUN apk add --no-cache bash

# Create project root
RUN mkdir -p /var/www/html

WORKDIR /var/www/html

RUN apk update \
    && apk upgrade \
    && rm -rf /var/cache/apk/*

# Install main packages and remove default server definition
RUN apk add --no-cache \
    curl \
    wget \
    nginx \
    zip \
    bash \
    vim \
    git \
    poppler-utils \
    vim \
    nginx-mod-http-headers-more-filter \
    ln -sf /dev/stdout /var/log/nginx/access.log; \
    ln -sf /dev/stderr /var/log/nginx/error.log

RUN set -xe \
    && apk add --no-cache --virtual .build-deps \
        libzip-dev \
        freetype-dev \
        icu-dev \
        libmcrypt-dev \
        libjpeg-turbo-dev \
        libpng-dev \
        libxslt-dev \
        patch \
        openssh-client

COPY ./security.conf /etc/nginx/server-opts.d/security.conf

# Use the build arguments to change the UID
# and GID of www-data while also changing
# the file permissions for NGINX
RUN docker-php-serversideup-set-id www-data $USER_ID:$GROUP_ID && \
    \
    # Update the file permissions for our NGINX service to match the new UID/GID
    docker-php-serversideup-set-file-permissions --owner $USER_ID:$GROUP_ID --service nginx

# Drop back to our unprivileged user
USER www-data

and adding this to security.conf:

#
# Security Headers
#

# Prevent IFRAME spoofing attacks
add_header X-Frame-Options "SAMEORIGIN" always;

# Prevent MIME attacks
add_header X-Content-Type-Options "nosniff" always;

# Prevent Referrer URL from being leaked
add_header Referrer-Policy "no-referrer-when-downgrade" always;

# Clear the X-Powered-By header
fastcgi_hide_header X-Powered-By;

#Clear Vary header
more_clear_headers 'Vary';

# Clear Server header
more_clear_headers 'Server';

# Configure Content Security Policy
# UPDATE - September 2020: Commenting this out until we grasp better security requirements
#add_header Content-Security-Policy "default-src 'self' http:https:data:blob:'unsafe-inline'" always;

# Enable HSTS
add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;

# Prevent access to . files (the well-known directory)
location ~ /\.(?!well-known) {
    deny all;
}

it does not work.

Thank you for your support !

[kilwir76]

any one has a anwser ?

[jaydrogers]

I was able to get your config to copy over mine (which I would've recommended):

COPY ./security.conf /etc/nginx/server-opts.d/security.conf

But your config doesn't seem valid:

[kilwir76]

Ok but how to add this lib :
nginx-mod-http-headers-more-filter on your Base Image ?

[kilwir76]

So if I start again we cannot modify the nginx used by adding new modules to exclude the Server header. This is very annoying in terms of security.

[kilwir76]

anywone ? @jaydrogers ? can you test if possible plz . How to hide headers for security

[kilwir76]

ok i found this problem . I can't add new nginx modules to my dockerfile, which calls your own docker.
it's up to you to update your docker to implement the nginx http_header_module to be able to do this kind of action

Can you update that ? For security ?