Nextcloud：错误 Headers 检测
Nextcloud : Bad Headers detection
我实际上遇到了 Nextcloud 14 的问题（全新安装）
There are some warnings regarding your setup.
Use of the the built in php mailer is no longer supported. Please update >your email server settings ↗.
The "X-XSS-Protection" HTTP header is not set to "1; mode=block". This is a potential security or privacy risk, as it is recommended to adjust this setting accordingly.
The "X-Content-Type-Options" HTTP header is not set to "nosniff". This is a potential security or privacy risk, as it is recommended to adjust this setting accordingly.
The "Referrer-Policy" HTTP header is not set to "no-referrer", "no-referrer-when-downgrade", "strict-origin" or "strict-origin-when-cross-origin". This can leak referer information. See the W3C Recommendation ↗.
Example
就像你在 nextcloud 上面看到的那样，我没有正确配置 header :
但是在我的 httpd.conf 中（我使用 Arch BTW <3）：
Header always set Content-Security-Policy "upgrade-insecure-requests"
Header always set Referrer-Policy "same-origin"
Header always set X-Frame-Options "SAMEORIGIN"
Header always set X-XSS-Protection "1; mode=block"
Header always set X-content-Type-Options "nosniff"
Header always set Strict-Transport-Security "max-age=15768000; includeSubDomains; preload"
我不明白为什么它不起作用，我什至尝试查看使用了哪个 header 和这个 header :
Request URL: https://cloud.schmitt-etienne.fr/index.php/settings/admin/overview
Request Method: GET
Status Code: 200
Remote Address: [2a01:e34:eeab:eb60:ffff:ffff:ffff:ffff]:443
Referrer Policy: no-referrer
cache-control: no-cache, no-store, must-revalidate
content-length: 27725
content-security-policy: upgrade-insecure-requests
content-type: text/html; charset=UTF-8
date: Wed, 12 Sep 2018 18:22:45 GMT
expires: Thu, 19 Nov 1981 08:52:00 GMT
pragma: no-cache
referrer-policy: same-origin
server: Apache
status: 200
strict-transport-security: max-age=15768000; includeSubDomains; preload
x-content-type-options: nosniff
x-content-type-options: nosniff
x-download-options: noopen
x-frame-options: SAMEORIGIN
x-permitted-cross-domain-policies: none
x-powered-by: PHP/7.2.10
x-robots-tag: none
x-xss-protection: 1; mode=block
x-xss-protection: 1; mode=block
:authority: cloud.schmitt-etienne.fr
:method: GET
:path: /index.php/settings/admin/overview
:scheme: https
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8
accept-encoding: gzip, deflate, br
accept-language: fr-FR,fr;q=0.9,en-US;q=0.8,en;q=0.7
cache-control: max-age=0
cookie:
upgrade-insecure-requests: 1
想看的可以自己去我的网站看看see yourself :
如果我遗漏了什么，我很高兴听到任何评论！
祝你有愉快的一天:)
我刚刚发现 nextcloud 包含在 .htaccess 中，他设置了自己的 header，所以 headers 被发送了两次，这就是原因:)
永远不要停止尝试和学习！
我实际上遇到了 Nextcloud 14 的问题（全新安装）
There are some warnings regarding your setup.
Use of the the built in php mailer is no longer supported. Please update >your email server settings ↗.
The "X-XSS-Protection" HTTP header is not set to "1; mode=block". This is a potential security or privacy risk, as it is recommended to adjust this setting accordingly.
The "X-Content-Type-Options" HTTP header is not set to "nosniff". This is a potential security or privacy risk, as it is recommended to adjust this setting accordingly.
The "Referrer-Policy" HTTP header is not set to "no-referrer", "no-referrer-when-downgrade", "strict-origin" or "strict-origin-when-cross-origin". This can leak referer information. See the W3C Recommendation ↗.
Example
就像你在 nextcloud 上面看到的那样，我没有正确配置 header :
但是在我的 httpd.conf 中（我使用 Arch BTW <3）：
Header always set Content-Security-Policy "upgrade-insecure-requests"
Header always set Referrer-Policy "same-origin"
Header always set X-Frame-Options "SAMEORIGIN"
Header always set X-XSS-Protection "1; mode=block"
Header always set X-content-Type-Options "nosniff"
Header always set Strict-Transport-Security "max-age=15768000; includeSubDomains; preload"
我不明白为什么它不起作用，我什至尝试查看使用了哪个 header 和这个 header :
Request URL: https://cloud.schmitt-etienne.fr/index.php/settings/admin/overview
Request Method: GET
Status Code: 200
Remote Address: [2a01:e34:eeab:eb60:ffff:ffff:ffff:ffff]:443
Referrer Policy: no-referrer
cache-control: no-cache, no-store, must-revalidate
content-length: 27725
content-security-policy: upgrade-insecure-requests
content-type: text/html; charset=UTF-8
date: Wed, 12 Sep 2018 18:22:45 GMT
expires: Thu, 19 Nov 1981 08:52:00 GMT
pragma: no-cache
referrer-policy: same-origin
server: Apache
status: 200
strict-transport-security: max-age=15768000; includeSubDomains; preload
x-content-type-options: nosniff
x-content-type-options: nosniff
x-download-options: noopen
x-frame-options: SAMEORIGIN
x-permitted-cross-domain-policies: none
x-powered-by: PHP/7.2.10
x-robots-tag: none
x-xss-protection: 1; mode=block
x-xss-protection: 1; mode=block
:authority: cloud.schmitt-etienne.fr
:method: GET
:path: /index.php/settings/admin/overview
:scheme: https
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8
accept-encoding: gzip, deflate, br
accept-language: fr-FR,fr;q=0.9,en-US;q=0.8,en;q=0.7
cache-control: max-age=0
cookie:
upgrade-insecure-requests: 1
想看的可以自己去我的网站看看see yourself :
如果我遗漏了什么，我很高兴听到任何评论！
祝你有愉快的一天:)
我刚刚发现 nextcloud 包含在 .htaccess 中，他设置了自己的 header，所以 headers 被发送了两次，这就是原因:)
永远不要停止尝试和学习！