tests sécurisation headers

Author: cdebarros

.docker/nginx.apps.conf

@@ -6,13 +6,12 @@ server {
         root   /usr/share/nginx/html;
 
         server_tokens off;
-
-        add_header X-Frame-Options DENY;
-        add_header X-Content-Type-Options nosniff;
 
         location ~ /index.html|.*\.toml|.*\.json$ {
           expires -1;
           add_header Cache-Control 'no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0';
+          add_header X-Frame-Options DENY;
+          add_header X-Content-Type-Options nosniff;
         }
 
         location ~ .*\.css$|.*\.js$ {