Aug 26 - Enhance security 2

scripts/passkeeper-nginx.conf

@@ -10,10 +10,25 @@
 #   - Content-Security-Policy (HTTP header level — authoritative over meta tag)
 #   - Connection-level rate limiting zones for auth endpoints
 #   - Buffer and timeout hardening
+#
+# Phase 6 (502 fixes):
+#   - proxy_connect_timeout / proxy_read_timeout / proxy_send_timeout made
+#     explicit. proxy_read_timeout MUST stay BELOW the `timeout` value in
+#     gunicorn.conf.py (90s): if Gunicorn kills the worker first the connection
+#     is severed mid-response and Nginx reports 502; if Nginx gives up first the
+#     client gets a clean 504 instead.
+#   - Security headers repeated inside the /static/ location block. Nginx drops
+#     ALL inherited add_header directives in any block that declares one of its
+#     own, so /static/'s Cache-Control header was silently stripping CSP, HSTS,
+#     X-Frame-Options and nosniff from every JS and CSS asset.
 
 # ── Rate limiting zones ────────────────────────────────────────────────────────
-# auth_limit: 10 req/s per IP for auth endpoints (login, register, MFA verify)
-# api_limit:  60 req/s per IP for all other API endpoints
+# NOTE the units: these are per MINUTE (r/m), not per second. api_limit is
+# therefore 1 req/s sustained for the whole API, with burst=20 absorbing spikes.
+# A vault page load fires several /api/* calls, so tightening these further will
+# surface as 429s to normal users.
+# auth_limit: 10 req/min per IP for auth endpoints (login, register, MFA verify)
+# api_limit:  60 req/min per IP for all other API endpoints
 limit_req_zone $binary_remote_addr zone=auth_limit:10m rate=10r/m;
 limit_req_zone $binary_remote_addr zone=api_limit:10m  rate=60r/m;
 
@@ -27,14 +42,14 @@ server {
     include             /etc/letsencrypt/options-ssl-nginx.conf;
     ssl_dhparam         /etc/letsencrypt/ssl-dhparams.pem;
 
-    # Modern TLS only
-    ssl_protocols TLSv1.2 TLSv1.3;
-    ssl_prefer_server_ciphers on;
+    # options-ssl-nginx.conf (managed by Certbot) already sets ssl_protocols,
+    # ssl_prefer_server_ciphers, ssl_session_timeout and ssl_session_tickets.
+    # Repeating them here conflicts whenever Certbot updates its managed file.
     ssl_session_cache shared:SSL:10m;
-    ssl_session_timeout 1d;
-    ssl_session_tickets off;
 
     # ── Security headers ──────────────────────────────────────────────────────
+    # IMPORTANT: these are repeated verbatim inside the /static/ block below.
+    # Keep the two copies in sync whenever either is modified.
     # HSTS: enforce HTTPS for 1 year; include subdomains; allow preload submission
     add_header Strict-Transport-Security "max-age=31536000; includeSubDomains; preload" always;
 
@@ -68,11 +83,31 @@ server {
     keepalive_timeout     15s;
     send_timeout          10s;
 
+    # ── Proxy timeouts ────────────────────────────────────────────────────────
+    # proxy_read_timeout must stay BELOW gunicorn.conf.py `timeout` (90s) so
+    # Nginx is the side that gives up first and the client sees 504, not 502.
+    # proxy_connect_timeout is short — Gunicorn is on loopback.
+    proxy_connect_timeout  5s;
+    proxy_read_timeout    60s;
+    proxy_send_timeout    10s;
+
     # ── Static files ──────────────────────────────────────────────────────────
+    # Every add_header from the server block MUST be repeated here. Nginx drops
+    # all inherited add_header directives in any location that declares one of
+    # its own, so without this the Cache-Control below silently strips CSP,
+    # HSTS, X-Frame-Options and nosniff from every static asset.
     location /static/ {
         alias   /home/spuser/PassKeeper/app/static/;
         expires 30d;
-        add_header Cache-Control "public, immutable";
+        add_header Cache-Control             "public, immutable"                            always;
+        add_header Strict-Transport-Security "max-age=31536000; includeSubDomains; preload" always;
+        add_header X-Frame-Options           "DENY"                                         always;
+        add_header X-Content-Type-Options    "nosniff"                                      always;
+        add_header Referrer-Policy           "strict-origin-when-cross-origin"              always;
+        add_header Permissions-Policy        "geolocation=(), camera=(), microphone=()"     always;
+        add_header Content-Security-Policy
+            "default-src 'self'; script-src 'self'; style-src 'self'; img-src 'self' data:; font-src 'self'; connect-src 'self' https://api.pwnedpasswords.com; frame-ancestors 'none';"
+            always;
     }
 
     # ── Auth endpoints — stricter Nginx-level rate limit ──────────────────────