Note: please note that Liferay has renamed its Liferay Experience
Could offerings to Liferay SaaS (formerly LXC) and
Liferay PaaS (formerly LXC-SM).
Issue
- While adding the below security headers in nginx.conf file of the web server:
add_header Referrer-Policy "no-referrer";
add_header Permissions-Policy "microphone=(),camera=()"; - The mentioned security headers are reflected for the 200 response pages but not on the 404 not found pages.
-
Steps to check:
1. Navigate to any page.
2. Inspect the browser and click on the network tab.
3. Reload the page and click on the URL of that particular page.
4. Drop down the response headers. - Observed Behavior: Security headers are visible for 200 responses but not on the 404 response.
- Expected Behavior: Security headers should be visible for every response page.
Environment
- Liferay Paas
- Nginx
Resolution
- To achieve the desired behavior, add the 'always' parameter at the end of the headers, like below:
add_header Referrer-Policy "no-referrer" always;
add_header Permissions-Policy "microphone=(),camera=()" always;