title: How to set nginx conf (403 forbidden page) to pass OWASP security test
body: <p>This is my nginx conf: </p>
  
  <pre><code>upstream django {
  
      server 127.0.0.1:8001; 
  }
  
  server {
      listen     80;
      server_name 127.0.0.1;  
      charset     utf-8;
  
      #security
      add_header X-Content-Type-Options "nosniff";
      add_header X-Frame-Options "DENY";
      add_header X-XSS-Protection "1; mode=block";
  
      location /static {
  
          alias /usr/share/nginx/mysite/staticfiles;  
  
      }
  
      location / {
          uwsgi_pass  django;
          include     /etc/nginx/uwsgi_params; 
      }
  }
  </code></pre>
  
  <p>And my settings.py : </p>
  
  <pre><code>SECURE_BROWSER_XSS_FILTER = True
  SECURE_CONTENT_TYPE_NOSNIFF = True
  SESSION_COOKIE_SECURE = True
  SECURE_FRAME_DENY = True
  </code></pre>
  
  <p>But It still have security problem with static files, What else should I set??    </p>
  
  <p><a href="https://i.stack.imgur.com/pYwdd.jpg" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/pYwdd.jpg" alt="enter image description here"></a></p>
  
  <p><strong>UPDATE</strong>  </p>
  
  <p>I found as @LinnTroll said ,It seems the the nginx 403 page didn't have security protect. How should I set it??   </p>
  
  <p><a href="https://i.stack.imgur.com/xvZ6X.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/xvZ6X.png" alt="enter image description here"></a></p>