@scalio-cloud/ui 0.35.0 → 0.36.0

package/README.md

@@ -38,6 +38,21 @@ module.exports = {
 Then remove the app's own `:root { --... }` / `.dark { --... }` blocks and the Google Fonts `@import` / `<link>`.
 Classes like `bg-primary`, `rounded-sm`, `font-display` keep working unchanged.
 
+## Security headers for nginx (from 0.36.0)
+
+`nginx/security-headers.conf` holds the security headers of every Scalio app (security review M6): `nosniff`,
+framing only by the own origin, no plugins, `Referrer-Policy`, no camera/microphone/location. No script policy.
+Copy it in the nginx stage of the frontend Dockerfile and include it in the server block and in every `location`
+that has its own `add_header` (nginx drops the server-level lines there):
+
+```dockerfile
+COPY --from=build /app/node_modules/@scalio-cloud/ui/nginx/security-headers.conf /etc/nginx/snippets/
+```
+
+```nginx
+include /etc/nginx/snippets/security-headers.conf;
+```
+
 ## App header (React)
 
 Every app shows the same header on the right, always in this order: (app actions), status, language, theme,

package/nginx/security-headers.conf

@@ -0,0 +1,9 @@
+# Security headers for every Scalio app (security review M6). Shipped in @scalio-cloud/ui, copied by each app's
+# Dockerfile to /etc/nginx/snippets/. Include it in the server block AND in every location that has its own
+# add_header: nginx drops the server-level add_header lines in such a location.
+# No script policy here (an app could break); framing only by the own origin (Nexus frames its own pages).
+add_header X-Content-Type-Options "nosniff" always;
+add_header X-Frame-Options "SAMEORIGIN" always;
+add_header Content-Security-Policy "frame-ancestors 'self'; object-src 'none'; base-uri 'self'" always;
+add_header Referrer-Policy "strict-origin-when-cross-origin" always;
+add_header Permissions-Policy "camera=(), microphone=(), geolocation=(), payment=()" always;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@scalio-cloud/ui",
-  "version": "0.35.0",
+  "version": "0.36.0",
   "description": "Scalio Control Room design tokens, Tailwind preset, self-hosted fonts, the shared app header, sign-in layout, sidebar and page blocks",
   "license": "SEE LICENSE IN README.md",
   "private": false,
@@ -22,7 +22,8 @@
     "./react": "./react/index.js",
     "./shell.css": "./shell.css",
     "./auth.css": "./auth.css",
-    "./nav.css": "./nav.css"
+    "./nav.css": "./nav.css",
+    "./nginx/*": "./nginx/*"
   },
   "files": [
     "tokens.js",
@@ -35,6 +36,7 @@
     "auth.css",
     "nav.css",
     "react/",
+    "nginx/",
     "licenses/",
     "fonts/",
     "README.md",