# Security response headers for the dashboard shell and its assets.
#
# This file is included once per location rather than set once at the server
# level, because nginx only inherits add_header from an outer block when the
# inner block declares none of its own. Every location here sets Cache-Control,
# so a server-level declaration would be silently dropped in exactly the places
# that serve the app.
#
# The entrypoint fills the built policy's hashes and configured resource origins.
add_header X-Content-Type-Options "nosniff" always;
add_header X-Frame-Options "DENY" always;
add_header Referrer-Policy "strict-origin-when-cross-origin" always;
add_header Permissions-Policy "camera=(), microphone=(), geolocation=(), interest-cohort=()" always;
add_header Content-Security-Policy "default-src 'none'; script-src 'self'; style-src 'self'; object-src 'none'; base-uri 'none'; form-action 'self'; frame-ancestors 'none'" always;
add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;