无法为 NGINX reverse-proxy 缓存的内容设置 HTTP headers

Question

我有一个 Node.js 应用程序，运行在端口 8080 上，前面有一个 NGINX 服务器运行并充当缓存 reverse-proxy。

我希望 NGINX 缓存除一页以外的所有内容，我的应用程序的仪表板：/dashboard.

这是我目前的配置：

    server {

    listen       80;
    server_name  mydomain.name;

    # SECURITY
    add_header X-Frame-Options SAMEORIGIN;
    add_header X-XSS-Protection "1; mode=block";
    add_header X-Content-Type-Options nosniff;
    add_header Content-Security-Policy "default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval'; img-src 'self' https://gravatar.com; style-src 'self' 'unsafe-inline' https://fonts.googleapis.com; font-src 'self' https://fonts.gstatic.com; object-src 'none'";

    ...

    proxy_set_header       Host $host;
    proxy_set_header   X-Forwarded-For $remote_addr;

    location / {
        add_header X-Proxy-Cache $upstream_cache_status;
        proxy_cache            STATIC;
        proxy_pass         http://127.0.0.1:8080;
    }

    location /dashboard {
        proxy_pass         http://127.0.0.1:8080/dashboard;
    }
}

缓存似乎工作正常，但安全性 headers（X-XSS-Protection、Content-Security-Policy 等）似乎只添加到 /dashboard 而不是缓存页面，如 / 或 /login.

我当前的配置有问题吗？我该怎么做才能解决这个问题？

Answer 1

如果正在处理的位置块中存在 "add_headers"，则忽略位置块外部的任何 "add_header" 指令。由于“/dashboard”没有"add_header"，一级服务器正在使用

根据 docs:

There could be several add_header directives. These directives are inherited from the previous level if and only if there are no add_header directives defined on the current level.

无法为 NGINX reverse-proxy 缓存的内容设置 HTTP headers

Can't set HTTP headers for content cached by a NGINX reverse-proxy

security

caching

reverse-proxy

nginx

http-headers