From 3d8a505bd99b4463d4ac9006e1d14fbdf92d3852 Mon Sep 17 00:00:00 2001 From: elpatron Date: Mon, 1 Jun 2026 15:04:27 +0200 Subject: [PATCH] fix(nginx): security headers on index.html and PWA asset routes Co-authored-by: Cursor --- client/nginx.conf | 14 ++++++++++++-- 1 file changed, 12 insertions(+), 2 deletions(-) diff --git a/client/nginx.conf b/client/nginx.conf index 037bb53..538ba87 100644 --- a/client/nginx.conf +++ b/client/nginx.conf @@ -13,12 +13,22 @@ server { # Service worker and app shell must revalidate so PWA updates are detected location ~* ^/(sw\.js|workbox-.*\.js|manifest\.webmanifest|version\.json)$ { root /usr/share/nginx/html; - add_header Cache-Control "no-cache, no-store, must-revalidate"; + add_header Cache-Control "no-cache, no-store, must-revalidate" always; + add_header X-Content-Type-Options "nosniff" always; + add_header X-Frame-Options "SAMEORIGIN" always; + add_header Referrer-Policy "strict-origin-when-cross-origin" always; + add_header Permissions-Policy "camera=(self), geolocation=(self), microphone=()" always; + add_header Content-Security-Policy "default-src 'self'; script-src 'self' https://plausible.elpatron.me; connect-src 'self' https://plausible.elpatron.me; img-src 'self' data: blob: https://*.tile.openstreetmap.org; style-src 'self' 'unsafe-inline'; font-src 'self'; object-src 'none'; base-uri 'self'; frame-ancestors 'self';" always; } location = /index.html { root /usr/share/nginx/html; - add_header Cache-Control "no-cache, must-revalidate"; + add_header Cache-Control "no-cache, must-revalidate" always; + add_header X-Content-Type-Options "nosniff" always; + add_header X-Frame-Options "SAMEORIGIN" always; + add_header Referrer-Policy "strict-origin-when-cross-origin" always; + add_header Permissions-Policy "camera=(self), geolocation=(self), microphone=()" always; + add_header Content-Security-Policy "default-src 'self'; script-src 'self' https://plausible.elpatron.me; connect-src 'self' https://plausible.elpatron.me; img-src 'self' data: blob: https://*.tile.openstreetmap.org; style-src 'self' 'unsafe-inline'; font-src 'self'; object-src 'none'; base-uri 'self'; frame-ancestors 'self';" always; } location / {