Nginx 安全响应头配置：HSTS/Referrer-Policy/Permissions-Policy 实战

示例配置：server {

listen 443 ssl;

server_name app.example.com;

ssl_certificate /etc/ssl/certs/app.crt;

ssl_certificate_key /etc/ssl/private/app.key;

add_header Strict-Transport-Security "max-age=31536000; includeSubDomains; preload" always;

add_header Referrer-Policy "strict-origin-when-cross-origin" always;

add_header Permissions-Policy "geolocation=(), microphone=(), camera=()" always;

add_header X-Content-Type-Options "nosniff" always;

add_header X-Frame-Options "SAMEORIGIN" always;

location / {

proxy_pass http://backend_app;

}

}