#521 Hide the nginx version, and send HSTS on the editor frame and embeds

[Anonymous]

Originally created by: athanclark

The live site's response headers are sound, with two small gaps (checked 2026-11-06 with ordinary page requests):

• Server version: nginx announces its version: server: nginx/1.24.0 (Ubuntu). server_tokens off; in the nginx configuration (and in the documented and shipped site configs) hides it.
• HSTS: it's sent on the site's pages, but not on /editor/frame and /embed/…, which are served with their own headers. Browsers apply HSTS from any response, so this only matters for a first visit that starts at one of those addresses. For consistency, send Strict-Transport-Security on them too (and consider includeSubDomains).

Everything else checked out: TLS 1.3 only (1.0 and 1.1 refused); a nonce-based content security policy with strict-dynamic and frame-ancestors 'none'; nosniff; no-referrer; and __Host-, Secure, HttpOnly, SameSite=Lax cookies.

---

From the security review of 2026-11-06 (commit 6776c44), finding I-20: hardening or information, filed publicly because it describes no way in. The exploitable findings are private security advisories.

🤖 Generated with Claude Code

https://claude.ai/code/session_011fFY8eruEi1xAkkMBni13B

[Anonymous]

Ticket changed by: athanclark

• status: open --> closed