#nginx屏蔽版本号
server_tokens off;
#Cookie设置成HttpOnly
add_header Set-Cookie "Path=/; HttpOnly; Secure";
#防止XSS，下面3行
add_header X-Frame-Options "SAMEORIGIN";
add_header X-XSS-Protection "1; mode=block";
add_header X-Content-Type-Options "nosniff";
add_header Strict-Transport-Security max-age=15768000;
#nginx配置动态跨域
set $cors_origin "";
if ($http_origin ~* "^(.?).yaozh.com$") { set $cors_origin $http_origin; }
if ($http_origin ~ "^(.?).yaozh.net$") { set $cors_origin $http_origin; }
if ($http_origin ~ "^(.*?).yaozh.cn$") { set $cors_origin $http_origin; }
add_header 'Access-Control-Allow-Origin' $cors_origin always;
add_header 'Access-Control-Allow-Credentials' 'true' always;
add_header 'Access-Control-Request-Method' 'GET,POST,PUT,DELETE,OPTIONS,PATCH' always;
add_header 'Access-Control-Allow-Headers' 'DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Authorization' always;
add_header Strict-Transport-Security max-age=15768000;