Update cross domain policy to only allow API access.

[rails.git] / config / lighttpd.conf

diff --git a/config/lighttpd.conf b/config/lighttpd.conf
index 5455e266d8b880f5251a225bc6fef3a29b5cf1bc..7a9e241452cc9ebf2dd80dc328e383bb7c6b4b23 100644 (file)
--- a/config/lighttpd.conf
+++ b/config/lighttpd.conf
@@ -65,9 +65,17 @@ mimetype.assign = (
   ".js" => "application/x-javascript",
   ".png" => "image/png",
   ".swf" => "application/x-shockwave-flash",
-  ".txt" => "text/plain"
+  ".txt" => "text/plain",
+  ".xml" => "text/xml"
 )
 
+#
+# Force special MIME type for crossdomain.xml files
+#
+$HTTP["url"] =~ "/crossdomain\.xml$" {
+  mimetype.assign = ( ".xml" => "text/x-cross-domain-policy" )
+}
+
 #
 # Enable compression of appropriate static content
 #
@@ -83,9 +91,10 @@ compress.filetype = (
 # Set expiry for static content
 #
 expire.url = (
+  "/export/" => "access 7 days",
   "/images/" => "access 10 years",
   "/javascripts/" => "access 10 years",
-  "/openlayers/" => "access 10 years",
+  "/openlayers/" => "access 7 days",
   "/stylesheets/" => "access 10 years"
 )