UN-3124 [FIX] : Add security headers and HTTP method restrictions to nginx

[jaseemjaskp]

Summary

This PR adds security hardening to the nginx configuration for the frontend.

Changes

• X-Content-Type-Options: Prevents MIME type sniffing
• X-Frame-Options: Prevents clickjacking by disallowing framing
• Referrer-Policy: Controls referrer information sent with requests
• Disable TRACE/TRACK methods: Prevents potential XST (Cross-Site Tracing) attacks
• Limit HTTP methods: Restricts allowed methods to GET and HEAD only (static file serving doesn't require POST as API calls go directly to the backend)

Testing

• Verified nginx configuration syntax
• Frontend loads correctly with the new headers

[coderabbitai]

Summary by CodeRabbit

• Bug Fixes
  • Improved server security by adding protective response headers (mitigates content sniffing, clickjacking, and referrer leakage).
  • Disabled unsafe HTTP methods (TRACE/TRACK) and restricted allowed methods for site root to only GET and HEAD, reducing potential request abuse.

_{✏️ Tip: You can customize this high-level summary in your review settings.}

Walkthrough

Added HTTP security headers (X-Content-Type-Options, X-Frame-Options, Referrer-Policy) to the nginx configuration. Disabled TRACE and TRACK methods by returning 405. Restricted the location / block to allow only GET and HEAD via a limit_except rule.

Changes

Cohort / File(s)	Summary
Nginx security hardening frontend/nginx.conf	Added response headers X-Content-Type-Options, X-Frame-Options, and Referrer-Policy. Disabled TRACE/TRACK methods with return 405. Restricted location / to only GET and HEAD using limit_except.

Estimated code review effort

🎯 1 (Trivial) | ⏱️ ~3 minutes

Pre-merge checks

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Description check	⚠️ Warning	The PR description covers key sections (Summary, Changes, Testing) but lacks several required template sections like What/Why/How, breaking changes assessment, and related issues.	Complete the standard description template including sections for What, Why, How, breaking changes assessment, and Related Issues/PRs to ensure consistency with repository standards.

✅ Passed checks (2 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly and specifically summarizes the main change: adding security headers and HTTP method restrictions to nginx configuration.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.

---

📜 Recent review details

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Cache: Disabled due to Reviews > Disable Cache setting

Knowledge base: Disabled due to Reviews -> Disable Knowledge Base setting

📥 Commits

Reviewing files that changed from the base of the PR and between 87f66af and 30915b3.

📒 Files selected for processing (1)

• frontend/nginx.conf

🚧 Files skipped from review as they are similar to previous changes (1)

• frontend/nginx.conf

⏰ Context from checks skipped due to timeout of 90000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (1)

• GitHub Check: build

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[coderabbitai]

Actionable comments posted: 2

🧹 Nitpick comments (1)

frontend/nginx.conf (1)

51-54: Consider removing redundant TRACE/TRACK check.

The explicit TRACE/TRACK blocking is redundant with the limit_except GET HEAD POST block (lines 62-63), which already denies all methods except the allowed ones. The limit_except directive is the preferred nginx approach for method restrictions.

However, keeping both provides defense in depth and earlier rejection at the server level, so this is acceptable if you prefer explicit blocking of these methods.

🔎 Optional simplification

If you prefer a simpler configuration, you can remove the server-level if block since limit_except already handles method restrictions:

 # Security headers
 add_header X-Content-Type-Options "nosniff" always;
 add_header X-Frame-Options "SAMEORIGIN" always;
 add_header X-XSS-Protection "1; mode=block" always;
 add_header Referrer-Policy "strict-origin-when-cross-origin" always;

-# Disable TRACE and TRACK methods
-if ($request_method ~ ^(TRACE|TRACK)$) {
-    return 405;
-}
-
 # If a react app URI is directly accessed we will get 404

📜 Review details

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Cache: Disabled due to Reviews > Disable Cache setting

Knowledge base: Disabled due to Reviews -> Disable Knowledge Base setting

📥 Commits

Reviewing files that changed from the base of the PR and between 8ddb575 and 1142365.

📒 Files selected for processing (1)

• frontend/nginx.conf

⏰ Context from checks skipped due to timeout of 90000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (1)

• GitHub Check: build

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud