@@ -233,7 +233,7 @@ http {
233233
234234 error_page 404 /404 .html;
235235
236- include snippets/ security-headers.conf;
236+ include security-headers.conf;
237237 add_header Cross-Origin-Resource-Policy "same-origin" always;
238238
239239 gzip on;
@@ -270,15 +270,15 @@ http {
270270
271271 location = /404 .html {
272272 internal ;
273- include snippets/ security-headers.conf;
273+ include security-headers.conf;
274274 add_header Cross-Origin-Resource-Policy "same-origin" always;
275275 }
276276
277277 location = /favicon.ico {
278278 if ( $http_accept ~ "image/svg\+ xml" ) {
279279 rewrite ^ /favicon.svg last;
280280 }
281- include snippets/ security-headers.conf;
281+ include security-headers.conf;
282282 # avoid breaking image hotlinking such as https://github.com/TryGhost/Ghost/issues/12880
283283 add_header Cross-Origin-Resource-Policy "cross-origin" always;
284284 add_header Cache-Control "public, max-age=604800" ;
@@ -287,7 +287,7 @@ http {
287287 }
288288
289289 location = /favicon.svg {
290- include snippets/ security-headers.conf;
290+ include security-headers.conf;
291291 # avoid breaking image hotlinking such as https://github.com/TryGhost/Ghost/issues/12880
292292 add_header Cross-Origin-Resource-Policy "cross-origin" always;
293293 add_header Cache-Control "public, max-age=604800" ;
@@ -296,7 +296,7 @@ http {
296296 }
297297
298298 location = /780febcc .mask-icon.svg {
299- include snippets/ security-headers.conf;
299+ include security-headers.conf;
300300 add_header Cross-Origin-Resource-Policy "same-origin" always;
301301 add_header Cache-Control "public, max-age=31536000, immutable" ;
302302 gzip_static on;
@@ -326,7 +326,7 @@ http {
326326 if ( $same_origin_lax != 1) {
327327 return 403 ;
328328 }
329- include snippets/ security-headers.conf;
329+ include security-headers.conf;
330330 add_header Cross-Origin-Resource-Policy "same-origin" always;
331331 add_header X-Robots-Tag "none" always;
332332 limit_req zone =flarum-limit burst=32 nodelay;
@@ -352,7 +352,7 @@ http {
352352 if ( $geoip2_data_autonomous_system_number = 35048 ) {
353353 return 403 ;
354354 }
355- include snippets/ security-headers.conf;
355+ include security-headers.conf;
356356 add_header Cross-Origin-Resource-Policy "same-origin" always;
357357 add_header X-Robots-Tag "none" always;
358358 limit_req zone =flarum-limit burst=32 nodelay;
@@ -453,7 +453,7 @@ http {
453453 return 403 ;
454454 }
455455
456- include snippets/ security-headers.conf;
456+ include security-headers.conf;
457457 add_header Cross-Origin-Resource-Policy "same-origin" always;
458458 add_header Content-Security-Policy "default-src 'none'; form-action 'none'; frame-ancestors 'none'; base-uri 'none'" always;
459459
@@ -517,35 +517,35 @@ http {
517517 }
518518
519519 location ~ \.webmanifest$ {
520- include snippets/ security-headers.conf;
520+ include security-headers.conf;
521521 add_header Cross-Origin-Resource-Policy "same-origin" always;
522522 add_header Cache-Control "public, max-age=604800" ;
523523 gzip_static on;
524524 brotli_static on;
525525 }
526526
527527 location ~ \.png$ {
528- include snippets/ security-headers.conf;
528+ include security-headers.conf;
529529 add_header Cross-Origin-Resource-Policy "same-origin" always;
530530 add_header Cache-Control "public, max-age=2592000" ;
531531 }
532532
533533 location ~ \.(?:css|js|js.map)$ {
534- include snippets/ security-headers.conf;
534+ include security-headers.conf;
535535 add_header Cross-Origin-Resource-Policy "same-origin" always;
536536 add_header Cache-Control "public, max-age=31536000" ;
537537 gzip_static on;
538538 brotli_static on;
539539 }
540540
541541 location ~ \.(?:ttf|eot|woff|woff2)$ {
542- include snippets/ security-headers.conf;
542+ include security-headers.conf;
543543 add_header Cross-Origin-Resource-Policy "same-origin" always;
544544 add_header Cache-Control "public, max-age=2592000" ;
545545 }
546546
547547 location ~ \.(?:json|txt|xml)$ {
548- include snippets/ security-headers.conf;
548+ include security-headers.conf;
549549 add_header Cross-Origin-Resource-Policy "same-origin" always;
550550 add_header Cache-Control "public, max-age=1800" ;
551551 gzip_static on;
@@ -559,7 +559,7 @@ http {
559559 if ( $same_origin_lax != 1) {
560560 return 403 ;
561561 }
562- include snippets/ security-headers.conf;
562+ include security-headers.conf;
563563 add_header Cross-Origin-Resource-Policy "same-origin" always;
564564 add_header X-Robots-Tag "none" always;
565565 limit_req zone =flarum-limit burst=32 nodelay;
@@ -582,7 +582,7 @@ http {
582582 if ( $same_origin_lax != 1) {
583583 return 403 ;
584584 }
585- include snippets/ security-headers.conf;
585+ include security-headers.conf;
586586 add_header Cross-Origin-Resource-Policy "same-origin" always;
587587 add_header X-Robots-Tag "none" always;
588588 limit_req zone =flarum-limit burst=32 nodelay;
0 commit comments