add_headers on text/html only?

Sergey Budnevitch sb at
Thu Jul 19 15:56:46 UTC 2012

On 18.07.2012, at 8:24, Nick Semenkovich wrote:

> I'm trying to add three headers for security to all text/html content:
> add_header X-Content-Type-Options 'nosniff';
> add_header X-Frame-Options 'DENY';
> add_header X-XSS-Protection '1; mode=block';
> I'd like to add these to a number of different sites & virtual hosts in nginx.
> Q: Is there an easy way to add this to multiple different hosts
> without updating every server{} block?
> Can I put this into an http{} section in some way (but still limit it
> to text/html)?

add_header will not add header with empty value, so

    add_header X-test $test;
    map $sent_http_content_type $test {
        text/html  1;

should work.

More information about the nginx mailing list