From 2a42e7743a894ca8d5dc2c626817a3d2a07ee714 Mon Sep 17 00:00:00 2001
From: Yovieee <inimemangyonas@gmail.com>
Date: Wed, 16 Sep 2026 03:20:35 +0700
Subject: [PATCH] fix(security): align nginx CSP connect-src/img-src with app
 WebSocket + data-URI needs (#624)

---
 nginx/nginx.conf | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/nginx/nginx.conf b/nginx/nginx.conf
index fe670f44..858a0247 100644
--- a/nginx/nginx.conf
+++ b/nginx/nginx.conf
@@ -4,6 +4,8 @@ server {
   add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;
   add_header X-Content-Type-Options    "nosniff"                          always;
   add_header Referrer-Policy           "strict-origin-when-cross-origin"  always;
+  add_header X-Frame-Options "DENY" always;
+  add_header Content-Security-Policy "default-src 'self'; connect-src 'self' ws: wss: https:; media-src 'self' blob:; img-src 'self' data:; style-src 'self' 'unsafe-inline'; script-src 'self';" always;
   location / {
     root /usr/share/nginx/html;
     index index.html;