start project

frontend/security-headers.conf

@@ -0,0 +1,19 @@
+# -----------------------------------------------------------------------------
+# Security headers, kept in one file and `include`d into every location.
+#
+# Why an include rather than declaring these once at server level: nginx's
+# add_header is *replacing*, not additive - the moment a location block
+# declares any add_header of its own (a Cache-Control, say), every header
+# inherited from the enclosing server block is silently dropped.  That is easy
+# to miss precisely because nothing fails: the page still loads, just without
+# its protections.  Including the same snippet everywhere makes each location
+# self-contained, so adding a Cache-Control to a block can no longer disarm it.
+#
+# Note there is deliberately no Content-Security-Policy here: the SPA and the
+# API documentation need different policies, so each location sets its own.
+# -----------------------------------------------------------------------------
+add_header X-Content-Type-Options "nosniff" always;
+add_header X-Frame-Options "DENY" always;
+add_header Referrer-Policy "strict-origin-when-cross-origin" always;
+add_header Permissions-Policy "camera=(), microphone=(), geolocation=(), interest-cohort=()" always;
+add_header Cross-Origin-Opener-Policy "same-origin" always;