From 66edc186f5e64c1acd6a66723b6b89cdfe7e05d3 Mon Sep 17 00:00:00 2001
From: Torsten Dittmann <torsten.dittmann@googlemail.com>
Date: Tue, 2 Sep 2025 13:21:29 +0200
Subject: [PATCH] Move security headers to API-only location block

---
 docker/nginx.conf | 12 ++++++------
 1 file changed, 6 insertions(+), 6 deletions(-)

diff --git a/docker/nginx.conf b/docker/nginx.conf
index e26105222..82f57204a 100644
--- a/docker/nginx.conf
+++ b/docker/nginx.conf
@@ -6,12 +6,6 @@ server {
 
     root /usr/share/nginx/html;
 
-    # Security headers for all locations
-    add_header X-UA-Compatible "IE=Edge";
-    add_header X-Frame-Options SAMEORIGIN;
-    add_header X-XSS-Protection "1; mode=block;";
-    add_header X-Content-Type-Options nosniff;
-
     # Only cache files in /console/_app/immutable/ for 1 year
     location /console/_app/immutable/ {
         try_files $uri =404;
@@ -35,6 +29,12 @@ server {
         expires 0;
         add_header Cache-Control "no-cache, no-store";
         add_header Pragma "no-cache";
+
+        # Security headers
+        add_header X-UA-Compatible "IE=Edge";
+        add_header X-Frame-Options SAMEORIGIN;
+        add_header X-XSS-Protection "1; mode=block;";
+        add_header X-Content-Type-Options nosniff;
     }
 
     location / {