Headers on N7 Docs

Origin Whitelisting with Origin Identity Secret

Mon, 01 Jan 0001 00:00:00 +0000

To enhance the security of your origin servers when using Nitrogen (N7), we have introduced the Origin Identity Secret (X-Nv-Access-Key) HTTP header. This feature allows your origin to verify that incoming requests have been processed and forwarded by the N7 network, preventing unauthorized direct access.

This document explains how the X-Nv-Access-Key works, how to manage your secret keys, and how to configure your origin server for seamless key rotation.

Overview#

When enabled, Nitrogen will add a unique X-Nv-Access-Key header to all requests forwarded to your origin server. The value of this header is a secret key that you can manage within the Nitrogen dashboard (dash.n7.io).

CORS

Mon, 01 Jan 0001 00:00:00 +0000

This page will show you the options to configure CORS (Cross-Origin Resource Sharing) response headers for your site. Refer this MDN link for more details.

It is a mechanism that allows a server to indicate any origins (domain, scheme, or port) other than its own from which a browser should permit loading resources.

Note: For demo purpose, we will be using www.nviztest.com domain as an example.

Prerequisite#

You must have a domain configured on Nitrogen.

Steps#

Click on Security menu, and open CORS tab.

CSP

Mon, 01 Jan 0001 00:00:00 +0000

This page will show you the step to configure CSP (Content-Security-Policy) response header for your site. Refer this MDN link for more details.

It allows website administrators to control resources the user agent is allowed to load for a given page. This helps guard against cross-site scripting attacks (Cross-site_scripting).

Note: For demo purpose, we will be using www.nviztest.com domain as an example.

Prerequisite#

You must have a domain configured on Nitrogen.

Steps#

Click on Security menu, and open CSP tab.

HSTS

Mon, 01 Jan 0001 00:00:00 +0000

This page will show you steps to configure HSTS (Strict-Transport-Security) response header for your site. Refer this MDN link for more details.

HSTS response header informs browsers that the site should only be accessed using HTTPS, and that any future attempts to access it using HTTP should automatically be converted to HTTPS.

When a browser knows that a domain has enabled HSTS, it does two things:

Always uses an https:// connection, even when clicking on an http:// link or after typing a domain into the location bar without specifying a protocol.
Removes the ability for users to click through warnings about invalid certificates.

Note: For demo purpose, we will be using www.nviztest.com domain as an example.

XSS

Mon, 01 Jan 0001 00:00:00 +0000

This page will show you the options to configure XSS (Cross-Site-Scripting) response headers for your site.

Cross-site scripting (XSS) is a security exploit which allows an attacker to inject into a website malicious client-side code. These attacks succeed if the Web app does not employ enough validation or encoding. Refer this MDN link for more details.

Note: For demo purpose, we will be using www.nviztest.com domain as an example.

Prerequisite#

You must have a domain configured on Nitrogen.

Steps#

Click on Security menu, and open XSS tab.