tree 661d70a90bc809b28d859bf35aae8a35d756ed51
parent 42ed80522120acd4337f0ae7f33e9fe62e71ff02
author Joseph Reynolds <jrey@us.ibm.com> 1535683177 -0500
committer Brad Bishop <bradleyb@fuzziesquirrel.com> 1537812921 -0400

Nginx adds http security headers

Nginx now adds security-related headers to HTTP responses per
https://www.owasp.org/index.php/OWASP_Secure_Headers_Project
and consistent with openbmc/bmcweb (see header file
include/security_headers_middleware.hpp).

Tested:
 curl -D headers http://${bmc}
   redirects to https
   No security headers apply, and none are sent
 curl https://${bmc}
   contains security headers and works properly
 curl https://${bmc}/xyz/openbmc_project/software
   contains Strict-Transport-Security header, and works
 curl ... -X POST -T ${image} https://${bmc}/upload/image"
   works
 firefox http redirects to https
 firefox https://${bmc}/ logs in and works

Resolves openbmc/openbmc#3195

(From meta-ibm rev: 8202b2639cba28a71640db48e38f6b7f1d3eaed0)

Change-Id: Ie20169abbca02471fa5dc89bebba8a6cdf722cd6
Signed-off-by: Joseph Reynolds <jrey@us.ibm.com>
Signed-off-by: Brad Bishop <bradleyb@fuzziesquirrel.com>