From 904df21d43a24248092b9cbcbe230221591360ad Mon Sep 17 00:00:00 2001
From: RinZ27 <222222878+RinZ27@users.noreply.github.com>
Date: Wed, 11 Mar 2026 21:43:18 +0700
Subject: [PATCH] Fix Nginx header inheritance for /files location

---
 resources/core/nginx/nginx-template.conf | 15 ++++++++++-----
 1 file changed, 10 insertions(+), 5 deletions(-)

diff --git a/resources/core/nginx/nginx-template.conf b/resources/core/nginx/nginx-template.conf
index 2e23f5fd..8aaf0782 100644
--- a/resources/core/nginx/nginx-template.conf
+++ b/resources/core/nginx/nginx-template.conf
@@ -21,11 +21,11 @@ server {
 	proxy_buffers 4 256k;
 	proxy_busy_buffers_size 256k;
 
-	add_header X-Frame-Options "SAMEORIGIN";
-	add_header Strict-Transport-Security "max-age=63072000; includeSubDomains; preload";
-	add_header X-Content-Type-Options nosniff;
-	add_header X-XSS-Protection "1; mode=block";
-	add_header Referrer-Policy "same-origin, strict-origin-when-cross-origin";
+	add_header X-Frame-Options "SAMEORIGIN" always;
+	add_header Strict-Transport-Security "max-age=63072000; includeSubDomains; preload" always;
+	add_header X-Content-Type-Options nosniff always;
+	add_header X-XSS-Protection "1; mode=block" always;
+	add_header Referrer-Policy "same-origin, strict-origin-when-cross-origin" always;
 
 	set_real_ip_from ${UPSTREAM_REAL_IP_ADDRESS};
 	real_ip_header ${UPSTREAM_REAL_IP_HEADER};
@@ -59,6 +59,11 @@ server {
 		rewrite ^(.+)\.html$ $1 permanent;
 
 		location ~ ^/files/.*.(htm|html|svg|xml) {
+			add_header X-Frame-Options "SAMEORIGIN" always;
+			add_header Strict-Transport-Security "max-age=63072000; includeSubDomains; preload" always;
+			add_header X-Content-Type-Options nosniff always;
+			add_header X-XSS-Protection "1; mode=block" always;
+			add_header Referrer-Policy "same-origin, strict-origin-when-cross-origin" always;
 			add_header Content-disposition "attachment";
 			try_files /${FRAPPE_SITE_NAME_HEADER}/public/$uri @webserver;
 		}