fix: retain security headers on frontend assets

2026-09-15 15:26:49 +03:00
parent 0bbfed321a
commit 242e7d8c2e
2 changed files with 15 additions and 4 deletions
@@ -46,6 +46,14 @@ server {
        root /usr/share/nginx/html;
        try_files $uri =404;
        expires 30d;
+        # Bu blok kendi add_header direktifini kullandığı için üst seviyedeki
+        # başlıkları nginx otomatik miras almaz; güvenlik başlıklarını tekrarla.
+        add_header X-Content-Type-Options "nosniff" always;
+        add_header Referrer-Policy "no-referrer" always;
+        add_header Permissions-Policy "camera=(), microphone=(), geolocation=()" always;
+        add_header X-Frame-Options "DENY" always;
+        add_header Content-Security-Policy "default-src 'self'; base-uri 'self'; object-src 'none'; frame-ancestors 'none'; script-src 'self' https://accounts.google.com; style-src 'self' 'unsafe-inline' https://fonts.googleapis.com; font-src 'self' https://fonts.gstatic.com data:; img-src 'self' data: blob: https:; connect-src 'self' https:; worker-src 'self' blob:; frame-src 'self' https://accounts.google.com" always;
+        add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;
        add_header Cache-Control "public, no-transform";
    }