Security-Header-Spickzettel: empfohlene Werte und fertige Konfiguration

server {
    listen 443 ssl;
    server_name example.com;
    server_tokens off;

    add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;
    add_header Content-Security-Policy "default-src 'self'; script-src 'self'; object-src 'none'; base-uri 'self'; frame-ancestors 'self'; form-action 'self'; upgrade-insecure-requests" always;
    add_header X-Frame-Options "SAMEORIGIN" always;
    add_header X-Content-Type-Options "nosniff" always;
    add_header Referrer-Policy "strict-origin-when-cross-origin" always;
    add_header Permissions-Policy "camera=(), microphone=(), geolocation=(), payment=(), usb=(), browsing-topics=()" always;
    add_header Cross-Origin-Opener-Policy "same-origin-allow-popups" always;
    add_header Cross-Origin-Resource-Policy "same-site" always;
}

# HTTP dauerhaft auf HTTPS umleiten
server {
    listen 80;
    server_name example.com;
    return 301 https://$host$request_uri;
}

# VirtualHost für HTTPS oder .htaccess (mod_headers)
Header always set Strict-Transport-Security "max-age=31536000; includeSubDomains"
Header always set Content-Security-Policy "default-src 'self'; script-src 'self'; object-src 'none'; base-uri 'self'; frame-ancestors 'self'; form-action 'self'; upgrade-insecure-requests"
Header always set X-Frame-Options "SAMEORIGIN"
Header always set X-Content-Type-Options "nosniff"
Header always set Referrer-Policy "strict-origin-when-cross-origin"
Header always set Permissions-Policy "camera=(), microphone=(), geolocation=(), payment=(), usb=(), browsing-topics=()"
Header always set Cross-Origin-Opener-Policy "same-origin-allow-popups"
Header always set Cross-Origin-Resource-Policy "same-site"
Header unset X-Powered-By

# nur in der Serverkonfiguration (httpd.conf), nicht in .htaccess
ServerTokens Prod
ServerSignature Off

# VirtualHost für Port 80: dauerhaft auf HTTPS umleiten
Redirect permanent / https://example.com/

<configuration>
  <system.webServer>
    <httpProtocol>
      <customHeaders>
        <remove name="X-Powered-By" />
        <add name="Strict-Transport-Security" value="max-age=31536000; includeSubDomains" />
        <add name="Content-Security-Policy" value="default-src 'self'; script-src 'self'; object-src 'none'; base-uri 'self'; frame-ancestors 'self'; form-action 'self'; upgrade-insecure-requests" />
        <add name="X-Frame-Options" value="SAMEORIGIN" />
        <add name="X-Content-Type-Options" value="nosniff" />
        <add name="Referrer-Policy" value="strict-origin-when-cross-origin" />
        <add name="Permissions-Policy" value="camera=(), microphone=(), geolocation=(), payment=(), usb=(), browsing-topics=()" />
        <add name="Cross-Origin-Opener-Policy" value="same-origin-allow-popups" />
        <add name="Cross-Origin-Resource-Policy" value="same-site" />
      </customHeaders>
    </httpProtocol>
    <security>
      <requestFiltering removeServerHeader="true" />
    </security>
  </system.webServer>
</configuration>

import type {NextConfig} from 'next';

// Ohne Nonces braucht Next.js 'unsafe-inline' für Skripte und Styles
// (Next.js-Leitfaden „Content Security Policy“, Abschnitt „Without Nonces“)
const securityHeaders=[
  {key:'Strict-Transport-Security',value:"max-age=31536000; includeSubDomains"},
  {key:'Content-Security-Policy',value:"default-src 'self'; script-src 'self' 'unsafe-inline'; style-src 'self' 'unsafe-inline'; img-src 'self' blob: data:; font-src 'self'; object-src 'none'; base-uri 'self'; frame-ancestors 'self'; form-action 'self'; upgrade-insecure-requests"},
  {key:'X-Frame-Options',value:"SAMEORIGIN"},
  {key:'X-Content-Type-Options',value:"nosniff"},
  {key:'Referrer-Policy',value:"strict-origin-when-cross-origin"},
  {key:'Permissions-Policy',value:"camera=(), microphone=(), geolocation=(), payment=(), usb=(), browsing-topics=()"},
  {key:'Cross-Origin-Opener-Policy',value:"same-origin-allow-popups"},
  {key:'Cross-Origin-Resource-Policy',value:"same-site"},
];

const nextConfig:NextConfig={
  poweredByHeader:false,
  async headers(){
    return [{source:'/:path*',headers:securityHeaders}];
  },
};

export default nextConfig;