start project

frontend/proxy-backend.conf

@@ -0,0 +1,26 @@
+# -----------------------------------------------------------------------------
+# Shared configuration for every location proxied to the Django container.
+#
+# Django's SecurityMiddleware sets its own X-Frame-Options, nosniff,
+# Referrer-Policy and Cross-Origin-Opener-Policy, and nginx adds the same
+# names from security-headers.conf - so without the proxy_hide_header lines
+# below the client receives each one twice.  That is not merely untidy: on
+# /api/docs/ drf-spectacular relaxes COOP to "unsafe-none" while the edge
+# sends "same-origin", and a response carrying two contradictory
+# Cross-Origin-Opener-Policy values is one the browser is free to resolve
+# either way.  The edge is the single authority; the upstream copies are
+# dropped here.
+# -----------------------------------------------------------------------------
+proxy_hide_header X-Frame-Options;
+proxy_hide_header X-Content-Type-Options;
+proxy_hide_header Referrer-Policy;
+proxy_hide_header Cross-Origin-Opener-Policy;
+
+proxy_http_version 1.1;
+proxy_set_header Host $host;
+proxy_set_header X-Real-IP $remote_addr;
+proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+proxy_set_header X-Forwarded-Proto $scheme;
+proxy_set_header X-Request-ID $request_id;
+proxy_connect_timeout 5s;
+proxy_read_timeout 30s;