In my last TIL I talked about how to set additional security headers for Gitlab. But I also had to do this for other applications I was supporting, where it was more straight-forward to do it (meaning: with code).

I needed to set the access-control-allow-origin header in the other applications …

Recently, I had to configure some security headers in GitLab. GitLab uses Nginx as its web server, and it allows for easy configuration changes for some settings. For instance, enabling HTTP to HTTPS redirection can be done simply by setting nginx['redirect_http_to_https'] = true in the gitlab.rb configuration file.

However …