[GH-ISSUE #719] Add CSP, HSTS and X-Content-Type-Options #320

Open
opened 2026-02-26 10:31:51 +03:00 by kerem · 2 comments
Owner

Originally created by @rmsmgaspar on GitHub (Mar 14, 2024).
Original GitHub issue: https://github.com/ONLYOFFICE/Docker-DocumentServer/issues/719

This issue is unique.

  • I have used the search tool and did not find an issue describing my idea.

Your idea.

Regarding webpage security, there is the need to create headers security with:
Content Security Policy (CSP)
HTTP Strict Transport Security (HSTS)
X-Content-Type-Options
Right now this is not possible with the docker version, it's possible to have this implemented or with some environment variables to input?
thanks in advance.

Originally created by @rmsmgaspar on GitHub (Mar 14, 2024). Original GitHub issue: https://github.com/ONLYOFFICE/Docker-DocumentServer/issues/719 ### This issue is unique. - [X] I have used the [search tool](https://github.com/ONLYOFFICE/DocumentServer/issues?q=) and did not find an issue describing my idea. ### Your idea. Regarding webpage security, there is the need to create headers security with: Content Security Policy (CSP) HTTP Strict Transport Security (HSTS) X-Content-Type-Options Right now this is not possible with the docker version, it's possible to have this implemented or with some environment variables to input? thanks in advance.
Author
Owner

@igwyd commented on GitHub (Mar 19, 2024):

Hello @rmsmgaspar, we add automaticaly add_header X-Content-Type-Options nosniff; and add_header Strict-Transport-Security max-age=31536000; to the nginx config if you Running ONLYOFFICE Document Server using HTTPS and we have docker variables for settings up HSTS. Regarding CSP is not implemented, i create ticket #66988 with your proposal.
BTW, you can configure any security settings yourself if you use an external proxy, our examples for proxies are here.

<!-- gh-comment-id:2006436768 --> @igwyd commented on GitHub (Mar 19, 2024): Hello @rmsmgaspar, we add automaticaly ```add_header X-Content-Type-Options nosniff;``` and ```add_header Strict-Transport-Security max-age=31536000;``` to the nginx config if you [Running ONLYOFFICE Document Server using HTTPS](https://github.com/ONLYOFFICE/Docker-DocumentServer/tree/master?tab=readme-ov-file#running-onlyoffice-document-server-using-https) and we have [docker variables ](https://github.com/ONLYOFFICE/Docker-DocumentServer/tree/master?tab=readme-ov-file#available-configuration-parameters) for settings up HSTS. Regarding CSP is not implemented, i create ticket #66988 with your proposal. BTW, you can configure any security settings yourself if you use an external proxy, our examples for proxies are [here](https://helpcenter.onlyoffice.com/installation/docs-community-proxy.aspx).
Author
Owner

@rmsmgaspar commented on GitHub (Apr 3, 2024):

Thanks

<!-- gh-comment-id:2035590087 --> @rmsmgaspar commented on GitHub (Apr 3, 2024): Thanks
Sign in to join this conversation.
No milestone
No project
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference
starred/Docker-DocumentServer-ONLYOFFICE#320
No description provided.