github/penpot
1
0
Fork 0
mirror of https://github.com/penpot/penpot.git synced 2026-09-07 20:49:37 +00:00
Code Issues Packages Projects Releases Wiki Activity

🐳 Apply the common security headers to the external locations

Browse Source 
The three locations of nginx-external-locations.conf define their own add_header directives, which under nginx's inheritance rules discards every add_header from the enclosing server block. They were therefore served without any of the four security headers already shipped, and would equally have been served without the new CSP and HSTS ones.

Include the common file in all three, which is the pattern the development environment already follows for the equivalent locations.

Signed-off-by: David Barragán Merino <david.barragan@kaleidos.net>
This commit is contained in:
David Barragán Merino 2026-09-03 17:05:11 +02:00
parent a8ccb5e0cd
commit 17f994544d
1 changed files with 3 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
docker/images/files/nginx-external-locations.conf
View File

@ -7,6 +7,7 @@ location ~ ^/github/penpot-files/(.+)$ {
proxy_set_header User-Agent "curl/8.5.0"; proxy_set_header User-Agent "curl/8.5.0";
proxy_set_header Host "raw.githubusercontent.com"; proxy_set_header Host "raw.githubusercontent.com";
proxy_set_header Accept "*/*"; proxy_set_header Accept "*/*";
include /etc/nginx/nginx-security-headers.conf;
add_header Access-Control-Allow-Origin $http_origin; add_header Access-Control-Allow-Origin $http_origin;
proxy_buffering off; proxy_buffering off;
} }
@ -31,6 +32,7 @@ location ~ ^/internal/gfonts/font/(?<font_file>.+) {
proxy_cache penpot; proxy_cache penpot;
include /etc/nginx/nginx-security-headers.conf;
add_header Access-Control-Allow-Origin $http_origin; add_header Access-Control-Allow-Origin $http_origin;
add_header Cache-Control max-age=86400; add_header Cache-Control max-age=86400;
add_header X-Cache-Status $upstream_cache_status; add_header X-Cache-Status $upstream_cache_status;
@ -53,6 +55,7 @@ location ~ ^/internal/gfonts/css {
proxy_cache penpot; proxy_cache penpot;
include /etc/nginx/nginx-security-headers.conf;
add_header Access-Control-Allow-Origin $http_origin; add_header Access-Control-Allow-Origin $http_origin;
add_header Cache-Control max-age=86400; add_header Cache-Control max-age=86400;
add_header X-Cache-Status $upstream_cache_status; add_header X-Cache-Status $upstream_cache_status;