From 17f994544ded2a7f69058a8d6e39136343030ad2 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?David=20Barrag=C3=A1n=20Merino?= Date: Thu, 3 Sep 2026 17:05:11 +0200 Subject: [PATCH] :whale: Apply the common security headers to the external locations MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The three locations of nginx-external-locations.conf define their own add_header directives, which under nginx's inheritance rules discards every add_header from the enclosing server block. They were therefore served without any of the four security headers already shipped, and would equally have been served without the new CSP and HSTS ones. Include the common file in all three, which is the pattern the development environment already follows for the equivalent locations. Signed-off-by: David Barragán Merino --- docker/images/files/nginx-external-locations.conf | 3 +++ 1 file changed, 3 insertions(+) diff --git a/docker/images/files/nginx-external-locations.conf b/docker/images/files/nginx-external-locations.conf index c9c106864b..9cce57ca87 100644 --- a/docker/images/files/nginx-external-locations.conf +++ b/docker/images/files/nginx-external-locations.conf @@ -7,6 +7,7 @@ location ~ ^/github/penpot-files/(.+)$ { proxy_set_header User-Agent "curl/8.5.0"; proxy_set_header Host "raw.githubusercontent.com"; proxy_set_header Accept "*/*"; + include /etc/nginx/nginx-security-headers.conf; add_header Access-Control-Allow-Origin $http_origin; proxy_buffering off; } @@ -31,6 +32,7 @@ location ~ ^/internal/gfonts/font/(?.+) { proxy_cache penpot; + include /etc/nginx/nginx-security-headers.conf; add_header Access-Control-Allow-Origin $http_origin; add_header Cache-Control max-age=86400; add_header X-Cache-Status $upstream_cache_status; @@ -53,6 +55,7 @@ location ~ ^/internal/gfonts/css { proxy_cache penpot; + include /etc/nginx/nginx-security-headers.conf; add_header Access-Control-Allow-Origin $http_origin; add_header Cache-Control max-age=86400; add_header X-Cache-Status $upstream_cache_status;