-
Notifications
You must be signed in to change notification settings - Fork 0
/
web.config
96 lines (91 loc) · 4.42 KB
/
web.config
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
---
# Front Matter in a web.config file feels very, very wrong for some reason.
layout: null
---
<?xml version="1.0" encoding="utf-8"?>
<configuration>
<system.web>
<httpRuntime enableVersionHeader="false" />
</system.web>
<system.webServer>
<httpErrors errorMode="DetailedLocalOnly" defaultResponseMode="File" >
<remove statusCode="404" />
<error statusCode="404" path="404.html" />
</httpErrors>
<security>
<requestFiltering removeServerHeader="true" />
</security>
<httpProtocol>
<customHeaders>
<clear />
<add name="X-Frame-Options" value="SAMEORIGIN" />
<add name="X-Xss-Protection" value="1; mode=block" />
<add name="X-Content-Type-Options" value="nosniff" />
<add name="Referrer-Policy" value="origin-when-cross-origin"/>
<add name="X-Site-Version" value="{% project_version commit short %}-{{ jekyll.environment }}"/>
<add name="X-Powered-By" value="Chicken Nuggets and Szechuan Sauce"/>
</customHeaders>
<redirectHeaders>
<clear />
</redirectHeaders>
</httpProtocol>
<rewrite>
<rules>
<rule name="HTTP to HTTPS redirect" stopProcessing="true">
<match url="(.*)" />
<conditions>
<add input="{HTTPS}" pattern="off" ignoreCase="true" />
</conditions>
<action type="Redirect" url="https://{HTTP_HOST}/{R:1}"
redirectType="Permanent" />
</rule>
</rules>
<outboundRules>
<rule name="Add Strict-Transport-Security only when using HTTPS" enabled="true">
<match serverVariable="RESPONSE_Strict_Transport_Security" pattern=".*" />
<conditions>
<add input="{HTTPS}" pattern="on" ignoreCase="true" />
</conditions>
<action type="Rewrite" value="max-age=31536000; includeSubdomains; preload" />
</rule>
<rule name="Add Expect-CT only when using HTTPS" enabled="true">
<match serverVariable="RESPONSE_Expect_CT" pattern=".*" />
<conditions>
<add input="{HTTPS}" pattern="on" ignoreCase="true" />
</conditions>
<action type="Rewrite" value="max-age=0; report-uri=https://tcnz.report-uri.io/r/default/ct/reportOnly" />
</rule>
<rule name="CSP">
<match serverVariable="RESPONSE_Content-Security-Policy" pattern=".*" />
<action type="Rewrite" value="default-src https://site-assets.tc.nz; script-src https://site-assets.tc.nz https://az416426.vo.msecnd.net/scripts/a/ai.0.js 'report-sample'; style-src https://site-assets.tc.nz 'report-sample'; img-src 'self' https://site-assets.tc.nz; font-src https://site-assets.tc.nz; connect-src https://dc.services.visualstudio.com/v2/track; media-src https://site-assets-large.tc.nz; object-src 'none'; child-src 'none'; frame-src 'none'; worker-src 'none'; frame-ancestors 'none'; form-action 'self'; upgrade-insecure-requests; disown-opener; sandbox allow-forms allow-scripts; reflected-xss block; manifest-src 'none'; report-uri https://tcnz.report-uri.io/r/default/csp/enforce; require-sri-for script style;" />
</rule>
</outboundRules>
</rewrite>
<!-- Tell IIS how to handle HTML5-era MIMEs: https://madskristensen.net/post/prepare-webconfig-for-html5-and-css3 -->
<staticContent>
<mimeMap fileExtension=".mp4" mimeType="video/mp4" />
<mimeMap fileExtension=".m4v" mimeType="video/m4v" />
<mimeMap fileExtension=".ogg" mimeType="video/ogg" />
<mimeMap fileExtension=".ogv" mimeType="video/ogg" />
<mimeMap fileExtension=".webm" mimeType="video/webm" />
<mimeMap fileExtension=".oga" mimeType="audio/ogg" />
<mimeMap fileExtension=".spx" mimeType="audio/ogg" />
<mimeMap fileExtension=".svg" mimeType="image/svg+xml" />
<mimeMap fileExtension=".svgz" mimeType="image/svg+xml" />
<remove fileExtension=".eot" />
<mimeMap fileExtension=".eot" mimeType="application/vnd.ms-fontobject" />
<mimeMap fileExtension=".otf" mimeType="font/otf" />
<mimeMap fileExtension=".woff" mimeType="application/font-woff" />
</staticContent>
</system.webServer>
<location path="assets">
<system.webServer>
<httpProtocol>
<customHeaders>
<add name="Access-Control-Allow-Origin" value="*"/>
<add name="Access-Control-Allow-Methods" value="GET"/>
</customHeaders>
</httpProtocol>
</system.webServer>
</location>
</configuration>