finish setting up CORP headers and document issues

1 files changed, 10 insertions, 1 deletions

diff --git a/nginx/nginx.conf b/nginx/nginx.conf
index 0514bcbd..562a8502 100644
--- a/nginx/nginx.conf
+++ b/nginx/nginx.conf
@@ -250,8 +250,17 @@ http {
             brotli_static off;
         }
 
-        location ~ "\.(atom|json|pdf|txt|xml)$" {
+        location ~ "\.(atom|pdf)$" {
             include snippets/security-headers.conf;
+            # Chromium PDF range requests use wrong origin: https://bugs.chromium.org/p/chromium/issues/detail?id=1074261
+            # Thunderbird uses wrong origin for feeds: https://bugzilla.mozilla.org/show_bug.cgi?id=1698755
+            add_header Cross-Origin-Resource-Policy "cross-origin" always;
+            add_header Cache-Control "public, max-age=1800";
+        }
+
+        location ~ "\.(json|txt|xml)$" {
+            include snippets/security-headers.conf;
+            add_header Cross-Origin-Resource-Policy "same-origin" always;
             add_header Cache-Control "public, max-age=1800";
         }