From 1921bc33029c219d219647f7c9c3f8ff2bdae46b Mon Sep 17 00:00:00 2001 From: AdrianoDev Date: Mon, 21 Sep 2026 22:34:14 +0200 Subject: [PATCH] deploy(nginx): location statiche limitata a /static/, header ripetuti, rimossa /uploads/ morta (#38) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit La regex delle estensioni statiche ora richiede il prefisso /static/, non qualunque path con quell'estensione. Gli header di sicurezza del blocco server non si ereditano in un location che ha un proprio add_header (comportamento nginx): ripetuti lì. Rimossa location /uploads/: verificato che il backend non la monta, i file passano da /api/files (files.py). Co-Authored-By: Claude Sonnet 5 --- nginx/nginx.conf | 17 ++++++++--------- 1 file changed, 8 insertions(+), 9 deletions(-) diff --git a/nginx/nginx.conf b/nginx/nginx.conf index c38b266..02661ce 100644 --- a/nginx/nginx.conf +++ b/nginx/nginx.conf @@ -34,13 +34,6 @@ server { proxy_read_timeout 120s; } - # Upload files served by server - location /uploads/ { - proxy_pass http://server_backend; - proxy_set_header Host $host; - proxy_set_header X-Real-IP $remote_addr; - } - # All other requests → Flask client location / { proxy_pass http://client_frontend; @@ -50,12 +43,18 @@ server { proxy_set_header X-Forwarded-Proto $scheme; } - # Static file caching - location ~* \.(css|js|png|jpg|jpeg|gif|ico|svg|woff|woff2|ttf)$ { + # Static file caching. Limitata a /static/: un add_header in questo + # location spegne l'ereditarietà di quelli del blocco server (comportamento + # nginx), quindi vanno ripetuti qui. + location ~* ^/static/.*\.(css|js|png|jpg|jpeg|gif|ico|svg|woff|woff2|ttf)$ { proxy_pass http://client_frontend; proxy_set_header Host $host; expires 7d; add_header Cache-Control "public, immutable"; + add_header X-Frame-Options "SAMEORIGIN" always; + add_header X-Content-Type-Options "nosniff" always; + add_header X-XSS-Protection "1; mode=block" always; + add_header Referrer-Policy "strict-origin-when-cross-origin" always; } # SSL configuration (uncomment when using Let's Encrypt)