14-16 Mar 2026
Voltar ao catalogo

Nginx sem security headers

LOW-03
LowAchado ConfirmadoSegurancaRodada 1

Descricao

O nginx.conf do frontend nao possui headers de seguranca recomendados: X-Frame-Options, X-Content-Type-Options, Strict-Transport-Security, Content-Security-Policy.

Evidencia
`angular/nginx.conf` — ausencia completa de security headers.
Impacto Tecnico

Frontend vulneravel a clickjacking, MIME sniffing e downgrade attacks.

Impacto de Negocio

Superficie de ataque web ampliada.

Recomendacao

Adicionar headers recomendados pelo OWASP Secure Headers Project.

Arquivos Afetados

angular/nginx.conf

Achados Relacionados

{
  "id": "LOW-03",
  "title": "Nginx sem security headers",
  "severity": "Low",
  "type": "achado confirmado",
  "category": "security",
  "description": "O `nginx.conf` do frontend nao possui headers de seguranca recomendados: `X-Frame-Options`, `X-Content-Type-Options`, `Strict-Transport-Security`, `Content-Security-Policy`.",
  "evidence": "`angular/nginx.conf` — ausencia completa de security headers.",
  "technicalImpact": "Frontend vulneravel a clickjacking, MIME sniffing e downgrade attacks.",
  "businessImpact": "Superficie de ataque web ampliada.",
  "recommendation": "Adicionar headers recomendados pelo OWASP Secure Headers Project.",
  "files": [
    "angular/nginx.conf"
  ],
  "pass": 1,
  "relatedFindings": [
    "INFRA-16"
  ]
}