mirror of
https://github.com/penpot/penpot.git
synced 2026-09-16 07:38:19 -04:00
The three locations of nginx-external-locations.conf define their own add_header directives, which under nginx's inheritance rules discards every add_header from the enclosing server block. They were therefore served without any of the four security headers already shipped, and would equally have been served without the new CSP and HSTS ones. Include the common file in all three, which is the pattern the development environment already follows for the equivalent locations. Signed-off-by: David Barragán Merino <david.barragan@kaleidos.net>