improve examples in README to add common security related headers

[sbp-bvanb]

Something like custom headers: https://kubernetes.github.io/ingress-nginx/user-guide/nginx-configuration/annotations/#custom-headers

By default, the voucher should set some default headers in the response like Referrer-Policy

[bnfinet]

@sbp-bvanb thanks for the suggestion

Could you expand on this a bit? What's your motivation here? What problem are you trying to solve?

Is this kubernetes specific? Is this CORS specific? You should be able to add custom headers to the http request in NGINX.

[sbp-bvanb]

A number of default security headers should be present in multiple layers, also on application level like:

		c.Response().Header().Set("Referrer-Policy", "no-referrer")
		c.Response().Header().Set("Strict-Transport-Security", "max-age=31536000; includeSubDomains; preload")
		c.Response().Header().Set("X-Content-Type-Options", "nosniff")
		c.Response().Header().Set("X-Frame-Options", "DENY")

Other application like Grafana and ArgoCD do this as well if a request is issued to their services.

[bnfinet]

@sbp-bvanb I'm of the opinion that such headers should be added via NGINX

https://nginx.org/en/docs/http/ngx_http_headers_module.html

There are many security related headers and each have their subtle nuances.
https://cheatsheetseries.owasp.org/cheatsheets/HTTP_Headers_Cheat_Sheet.html
https://owasp.org/www-project-secure-headers/

I could see improving the documentation to highlight best practices. Would you be interested in developing a PR to make that addition?

[sbp-bvanb]

In my opinion it should be resolved in the code as well. In our case we have an AWS ALB and the Nginx-ingress controller cannot configure the headers there. Instead of putting an AWS CloudFront everywhere, it should be resolved in all layers. I am willing to create a code and documentation change the upcoming weeks and create a PR.

[bnfinet]

This shows a method of adding headers to the ingress controller. Is that a workable solution for you?

https://stackoverflow.com/questions/54083179/how-can-i-correctly-setup-custom-headers-with-nginx-ingress#55574720

[sbp-bvanb]

Yes tried that today, but is not working in conjunction with an AWS ALB.