Nextcloud : Bad Headers detection
I'm actually encounter a problem with Nextcloud 14 (clean install)
There are some warnings regarding your setup.
Use of the the built in php mailer is no longer supported. Please update >your email server settings ↗.
The "X-XSS-Protection" HTTP header is not set to "1; mode=block". This is a potential security or privacy risk, as it is recommended to adjust this setting accordingly.
The "X-Content-Type-Options" HTTP header is not set to "nosniff". This is a potential security or privacy risk, as it is recommended to adjust this setting accordingly.
The "Referrer-Policy" HTTP header is not set to "no-referrer", "no-referrer-when-downgrade", "strict-origin" or "strict-origin-when-cross-origin". This can leak referer information. See the W3C Recommendation ↗.
Like you could see above nextcloud explicitly say than i don't have this header correctly configured :
But in my httpd.conf (I Use Arch BTW <3 ) :
Header always set Content-Security-Policy "upgrade-insecure-requests" Header always set Referrer-Policy "same-origin" Header always set X-Frame-Options "SAMEORIGIN" Header always set X-XSS-Protection "1; mode=block" Header always set X-content-Type-Options "nosniff" Header always set Strict-Transport-Security "max-age=15768000; includeSubDomains; preload"
I don't understand why it's not working, I even tried see which header are used and this header is used :
Request URL: https://cloud.schmitt-etienne.fr/index.php/settings/admin/overview Request Method: GET Status Code: 200 Remote Address: [2a01:e34:eeab:eb60:ffff:ffff:ffff:ffff]:443 Referrer Policy: no-referrer cache-control: no-cache, no-store, must-revalidate content-length: 27725 content-security-policy: upgrade-insecure-requests content-type: text/html; charset=UTF-8 date: Wed, 12 Sep 2018 18:22:45 GMT expires: Thu, 19 Nov 1981 08:52:00 GMT pragma: no-cache referrer-policy: same-origin server: Apache status: 200 strict-transport-security: max-age=15768000; includeSubDomains; preload x-content-type-options: nosniff x-content-type-options: nosniff x-download-options: noopen x-frame-options: SAMEORIGIN x-permitted-cross-domain-policies: none x-powered-by: PHP/7.2.10 x-robots-tag: none x-xss-protection: 1; mode=block x-xss-protection: 1; mode=block :authority: cloud.schmitt-etienne.fr :method: GET :path: /index.php/settings/admin/overview :scheme: https accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8 accept-encoding: gzip, deflate, br accept-language: fr-FR,fr;q=0.9,en-US;q=0.8,en;q=0.7 cache-control: max-age=0 cookie: upgrade-insecure-requests: 1
You could go see my website yourself if you want to see yourself :
If i miss anything I missed I'm happy to hear any comment !
Have a nice day :)
1 Answers Nextcloud : Bad Headers detection
I just found than nextcloud come included with a .htaccess who set his own header, so the headers was send two times and that was the cause :)
Never stop trying and learning !