Magento CORS error (Access-Control-Allow-Origin)

https://absolutecommerce.co.uk/blog/cors-in-magento-2

/etc/nginx/magento2-cors.conf
add_header 'Access-Control-Allow-Origin' '*' 'always'; 

if ($request_method = 'OPTIONS') { 

  add_header 'Access-Control-Allow-Origin' '*' 'always'; 

  add_header 'Access-Control-Allow-Headers' 'x-requested-with' 'always'; 

  add_header 'Access-Control-Max-Age' 86400 'always'; 

  add_header 'Content-Length' 0 'always'; return 204; 

}

location /static/ { 

  location ~* \.(ico|jpg|jpeg|png|gif|svg|js|css|swf|eot|ttf|otf|woff|woff2)$ { 

    add_header X-Frame-Options "SAMEORIGIN"; 

    include /etc/nginx/magento2-cors.conf; 

  } 

  location ~* \.(zip|gz|gzip|bz2|csv|xml)$ { 

    add_header X-Frame-Options "SAMEORIGIN"; 

    include /etc/nginx/magento2-cors.conf; 

  } 

  add_header X-Frame-Options "SAMEORIGIN"; 

  include /etc/nginx/magento2-cors.conf; 

}

explanation CORS:

https://qna.habr.com/q/596375

Header Access-Control-Allow-* - это заголовки ответа, их должен отправлять сервер в ответ на запрос. 

Если запрос OPTIONS (браузер шлет сам перед основным запросом для проверки прав), то сервер должен так же ответить этими заголовками, но со статусом 204 и без тела
с клиента должен быть только заголовок Origin (откуда пришел запрос), если клиент в браузере, то браузер сам его отправит (X-Requested-With кстати тоже сам отправит)
а эти:
"Access-Control-Allow-Origin": "*",
"Access-Control-Allow-Methods" : "GET,POST,PUT,DELETE,OPTIONS",
"Access-Control-Allow-Headers": "Content-Type, Access-Control-Allow-Headers, Authorization, X-Requested-With"
должны быть с сервера, притом из Access-Control-Allow-Headers можно смело убрать Access-Control-Allow-Headers и X-Requested-With (первый Вы и не должны отправлять, а второй разрешен по умолчанию)

Nginx security headers

Usually, I added

X-Frame-Options SAMEORIGIN

There was a task with CWE-693: Protection Mechanism Failure
I added security headers for strong security.

Useful links
https://www.keycdn.com/blog/http-security-headers
https://devdocs.magento.com/guides/v2.3/config-guide/secy/secy-xframe.html
magento 1 since 1.9.2 version

Tested the site headers via https://securityheaders.com/
Added to nginx.conf in
http block

add_header x-xss-protection "1; mode=block" always;

to vhost.conf in
server block

add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;
add_header x-content-type-options "nosniff" always;
add_header feature-policy "autoplay 'none'; camera 'none'" always;
add_header Referrer-Policy "strict-origin-when-cross-origin" always;

Links related Referrer-Policy
https://scotthelme.co.uk/a-new-security-header-referrer-policy/
http://okiseleva.blogspot.com/2018/07/referrer-policy.html

It's the most difficult security header Content-Security-Policy

add_header Content-Security-Policy "default-src 'self'; img-src * 'self' data:; style-src 'self' 'unsafe-inline'; script-src * 'unsafe-inline' 'unsafe-eval'; frame-src *; object-src *; connect-src *; media-src *; font-src *;";

Links related Content-Security-Policy
https://benjaminhorn.io/code/content-security-policy-what-it-is-what-it-does-and-how-to-implement-it/
https://ole.michelsen.dk/blog/secure-your-website-with-content-security-policy.html

Error with img-src https://forum.framework7.io/t/content-security-policy-directive-img-src-self-data-https/5678

Short instruction for setting Content-Security-Policy header parameters:

Set to default-src 'none';
Open develop panel F12, check console log and add rules with all supported directives

Supported directives

default-src: Define loading policy for all resources type in case of a resource type dedicated directive is not defined (fallback) script-src: Define which scripts the protected resource can execute object-src: Define from where the protected resource can load plugins style-src: Define which styles (CSS) the user applies to the protected resource img-src: Define from where the protected resource can load images media-src: Define from where the protected resource can load video and audio frame-src: Define from where the protected resource can embed frames font-src: Define from where the protected resource can load fonts connect-src: Define which URIs the protected resource can load using script interfaces

Linux PHP remove http header X-Powered-By

Для безопасности лучше удалить такие headers
До удаления
curl -I -L example.com
x-powered-by: PHP/7.2.18

Чтобы удалить, прописываем в
php.ini
expose_php = off
И reload php
После этого таких заголовков не наблюдаем