##// END OF EJS Templates
u » pc » rhodecode-enterprise-ce-fork-pc
RSS

Fork of rhodecode-enterprise-ce

shadow-repos: use safer way to destroy shadow repositories....
shadow-repos: use safer way to destroy shadow repositories. we had reported errors on removal of shadow repos. Not reproduced, however suspecting are filesystem sync/symlink race-conditions on shared storage. End result were existing shadow-repo directories that tricked rhodecode into thinking shadow repos is existing, but infact it was a dummy structure semi-removed. Using shutil.move we ENSURE rhodecode doesn't read those back even if removal fails.
marcink - - Load All Authors

File last commit:

r1:854a839a default
r2791:27d869d5 stable
Show More
sec-x-frame.rst
56 lines | 1.8 KiB | text/x-rst | RstLexer
/ docs / admin / sec-x-frame.rst
History | Annotation | Raw |Copy content |Copy permalink

Securing HTTPS Connections

  • To secure your |RCE| instance against Cross Frame Scripting exploits, you should configure your webserver x-frame-options setting.
  • To configure your instance for HTTP Strict Transport Security, you need to configure the Strict-Transport-Security setting.

Nginx

In your nginx configuration, add the following lines in the correct files. For more detailed information see the :ref:`nginx-ws-ref` section.

# Add this line to the nginx.conf file
add_header X-Frame-Options SAMEORIGIN;

# This line needs to be added inside your virtual hosts block/file
add_header Strict-Transport-Security "max-age=31536000; includeSubdomains;";

Apache

In your :file:`apache2.conf` file, add the following line. For more detailed information see the :ref:`apache-ws-ref` section.

# Add this to your virtual hosts file
Header always append X-Frame-Options SAMEORIGIN

# Add this line in your virtual hosts file
Header always set Strict-Transport-Security "max-age=63072000; includeSubdomains; preload"

|RCE| Configuration

|RCE| can also be configured to force strict https connections and Strict Transport Security. To set this, configure the following options to true in the :file:`/home/{user}/.rccontrol/{instance-id}/rhodecode.ini` file.

## force https in RhodeCode, fixes https redirects, assumes it's always https
force_https = false

## use Strict-Transport-Security headers
use_htsts = false