diff --git a/backend/nginx.conf b/backend/nginx.conf index 1ce52ac..031887a 100644 --- a/backend/nginx.conf +++ b/backend/nginx.conf @@ -1,26 +1,22 @@ worker_processes 1; - events { worker_connections 1024; } - http { include /etc/nginx/mime.types; default_type application/octet-stream; - sendfile on; keepalive_timeout 65; - client_max_body_size 100M; - + upstream django { server 127.0.0.1:8000; } - + server { listen 80; server_name localhost; - + location / { proxy_pass http://django; proxy_set_header Host $host; @@ -28,28 +24,27 @@ http { proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header X-Forwarded-Proto $scheme; } - + location /static/ { alias /code/staticfiles/; } - - # Internal redirect path for protected media - location /protectedMedia/ { - internal; - alias /code/media/; - try_files $uri =404; - } - - # Special headers for PDF responses under /protectedMedia/ + + # Special handling for PDF files with CSP headers location ~ ^/protectedMedia/.*\.pdf$ { internal; alias /code/media/; try_files $uri =404; - add_header Content-Security-Policy "default-src 'self'; script-src 'none'; object-src 'none'; base-uri 'none'" always; add_header X-Content-Type-Options nosniff always; add_header X-Frame-Options SAMEORIGIN always; add_header Content-Disposition "inline" always; } + + # General protected media files (non-PDF) + location /protectedMedia/ { + internal; + alias /code/media/; + try_files $uri =404; + } } -} +} \ No newline at end of file