##// END OF EJS Templates
u » pc » rhodecode-enterprise-ce-fork-pc
RSS

Fork of rhodecode-enterprise-ce

http-proto: in case incoming requests come in as chunked stream the data to VCSServer....
http-proto: in case incoming requests come in as chunked stream the data to VCSServer. This should solve a problem of uploading large files to rhodecode. In case of git with small postBuffers GIT client streams data to the server. In such case we want to stream the data back again to vcsserver without reading it fully inside RhodeCode.
marcink - - Load All Authors

File last commit:

r1:854a839a default
r1423:8b2e03e1 default
Show More
sec-x-frame.rst
56 lines | 1.8 KiB | text/x-rst | RstLexer
/ docs / admin / sec-x-frame.rst
History | Annotation | Raw |Copy content |Copy permalink

Securing HTTPS Connections

  • To secure your |RCE| instance against Cross Frame Scripting exploits, you should configure your webserver x-frame-options setting.
  • To configure your instance for HTTP Strict Transport Security, you need to configure the Strict-Transport-Security setting.

Nginx

In your nginx configuration, add the following lines in the correct files. For more detailed information see the :ref:`nginx-ws-ref` section.

# Add this line to the nginx.conf file
add_header X-Frame-Options SAMEORIGIN;

# This line needs to be added inside your virtual hosts block/file
add_header Strict-Transport-Security "max-age=31536000; includeSubdomains;";

Apache

In your :file:`apache2.conf` file, add the following line. For more detailed information see the :ref:`apache-ws-ref` section.

# Add this to your virtual hosts file
Header always append X-Frame-Options SAMEORIGIN

# Add this line in your virtual hosts file
Header always set Strict-Transport-Security "max-age=63072000; includeSubdomains; preload"

|RCE| Configuration

|RCE| can also be configured to force strict https connections and Strict Transport Security. To set this, configure the following options to true in the :file:`/home/{user}/.rccontrol/{instance-id}/rhodecode.ini` file.

## force https in RhodeCode, fixes https redirects, assumes it's always https
force_https = false

## use Strict-Transport-Security headers
use_htsts = false