Merge pull request #29 from jemus42/patch-1

Add info about already set HTTP headers
2017-04-14 02:07:34 +02:00 · 2017-04-14 02:07:34 +02:00 · bdf7d53c9a
parent c23d32df4c dae0d21d57
commit bdf7d53c9a
1 changed files with 9 additions and 0 deletions
--- a/Running-Mastodon/Production-guide.md
+++ b/Running-Mastodon/Production-guide.md
@ -1,6 +1,15 @@
 Production guide
 ================

+The following HTTP readers are already set internally and should not be set again:
+
+```
+'Server'                 => 'Mastodon',
+'X-Frame-Options'        => 'DENY',
+'X-Content-Type-Options' => 'nosniff',
+'X-XSS-Protection'       => '1; mode=block',
+```
+
 ## Nginx

 Regardless of whether you go with the Docker approach or not, here is an example Nginx server configuration: