# Included into every location that sets its own add_header.
#
# nginx only inherits add_header directives into a nested block when that block
# declares none of its own. A location that sets Cache-Control therefore silently
# drops everything defined at server level, so these are included explicitly
# rather than relying on inheritance.

add_header X-Content-Type-Options nosniff always;
add_header X-Frame-Options DENY always;
add_header Referrer-Policy strict-origin-when-cross-origin always;

# The app loads no third-party scripts, styles, fonts or images: Angular bundles
# everything and the API is same-origin. 'unsafe-inline' for styles is required
# by Angular Material's runtime style injection.
add_header Content-Security-Policy "default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; font-src 'self'; connect-src 'self'; frame-ancestors 'none'; base-uri 'self'; form-action 'self'" always;