From c81a8ca500bab28f1435b880d98d2999025ecdc2 Mon Sep 17 00:00:00 2001 From: Jonas Elfering Date: Thu, 15 Oct 2026 10:23:53 +0200 Subject: [PATCH 1/6] docs(hosting): align static HTML and SVG CSP examples --- .../config-reference/server/apache.md | 22 +++++++++++++++++++ .../config-reference/server/caddy.md | 10 ++++++--- .../config-reference/server/nginx.md | 21 +++++++++++++++--- 3 files changed, 47 insertions(+), 6 deletions(-) diff --git a/resources/references/config-reference/server/apache.md b/resources/references/config-reference/server/apache.md index b40222374d..836718c457 100644 --- a/resources/references/config-reference/server/apache.md +++ b/resources/references/config-reference/server/apache.md @@ -20,3 +20,25 @@ The document root must always point to the public folder, to ensure all function CustomLog ${APACHE_LOG_DIR}/shopware.access.log combined ``` + +Enable `mod_rewrite` and `mod_headers`, and deploy the current `public/.htaccess` from the Shopware template. +The following additions restrict existing HTML files under `media/` and `thumbnail/`, and apply the same policy to SVG files. +Place the rewrite condition and rule before the existing rule that serves files directly; keep the header directives in the `mod_headers` block. + +```apache + + RewriteEngine On + RewriteCond %{REQUEST_FILENAME} -f + RewriteRule ^(?:media|thumbnail)/.*\.(?i:html)$ - [E=SHOPWARE_STATIC_HTML:1] + + + + Header set Content-Security-Policy "script-src 'none'; object-src 'none'; frame-src 'none'; base-uri 'none'; form-action 'none'" env=SHOPWARE_STATIC_HTML + + Header set Content-Security-Policy "script-src 'none'; object-src 'none'; frame-src 'none'; base-uri 'none'; form-action 'none'" + + +``` + +These rules leave application-rendered HTML and bundled HTML applications unchanged. +Custom static documents must work without scripts, embedded documents, base URL overrides or form submissions; images and styles remain permitted. diff --git a/resources/references/config-reference/server/caddy.md b/resources/references/config-reference/server/caddy.md index 9db63a85b1..9d696a78f2 100644 --- a/resources/references/config-reference/server/caddy.md +++ b/resources/references/config-reference/server/caddy.md @@ -1,5 +1,9 @@ # Caddy +The static-file policy below restricts existing SVG files and HTML files under `media/` and `thumbnail/`. +Application-rendered HTML and bundled HTML applications retain their own response policies. +Custom static documents must work without scripts, embedded documents, base URL overrides or form submissions; images and styles remain permitted. + ```text mydomain.com { header { @@ -7,12 +11,12 @@ mydomain.com { Referrer-Policy no-referrer-when-downgrade } - @svg { + @staticDocuments { file - path *.svg + path_regexp staticDocuments (?i)([.]svg$|^/(media|thumbnail)/.*[.]html$) } - header @svg Content-Security-Policy "script-src 'none'" + header @staticDocuments Content-Security-Policy "script-src 'none'; object-src 'none'; frame-src 'none'; base-uri 'none'; form-action 'none'" @default { not path /theme/* /media/* /thumbnail/* /bundles/* /css/* /fonts/* /js/* /recovery/* /sitemap/* diff --git a/resources/references/config-reference/server/nginx.md b/resources/references/config-reference/server/nginx.md index 9a35d03f6d..35567df448 100644 --- a/resources/references/config-reference/server/nginx.md +++ b/resources/references/config-reference/server/nginx.md @@ -4,6 +4,10 @@ The document root must always point to the public folder, to ensure all functionality works. ::: +The static-file policy below restricts SVG files and HTML files under `media/` and `thumbnail/`. +Missing HTML media files return 404; application-rendered HTML and bundled HTML applications retain their own response policies. +Custom static documents must work without scripts, embedded documents, base URL overrides or form submissions; images and styles remain permitted. + ```text server { listen 80; @@ -34,6 +38,14 @@ server { deny all; } + # Stored HTML must not affect pages rendered by PHP. + location ~* ^/(media|thumbnail)/.*[.]html$ { + try_files $uri =404; + expires 1y; + add_header Cache-Control "public, must-revalidate, proxy-revalidate"; + add_header Content-Security-Policy "script-src 'none'; object-src 'none'; frame-src 'none'; base-uri 'none'; form-action 'none'"; + } + location ~ ^/(theme|media|thumbnail|bundles|css|fonts|js|recovery|sitemap)/ { expires 1y; add_header Cache-Control "public, must-revalidate, proxy-revalidate"; @@ -45,13 +57,13 @@ server { open_file_cache_errors off; location ~* ^.+\.svg { - add_header Content-Security-Policy "script-src 'none'"; + add_header Content-Security-Policy "script-src 'none'; object-src 'none'; frame-src 'none'; base-uri 'none'; form-action 'none'"; add_header Cache-Control "public, must-revalidate, proxy-revalidate"; log_not_found off; } } - location ~* ^.+\.(?:css|cur|js|jpe?g|gif|ico|png|svg|webp|html|woff|woff2|xml)$ { + location ~* ^.+\.(?:css|cur|js|jpe?g|gif|ico|png|webp|html|woff|woff2|xml)$ { expires 1y; add_header Cache-Control "public, must-revalidate, proxy-revalidate"; @@ -72,7 +84,10 @@ server { } location ~* ^.+\.svg$ { - add_header Content-Security-Policy "script-src 'none'"; + try_files $uri /index.php$is_args$args; + expires 1y; + add_header Cache-Control "public, must-revalidate, proxy-revalidate"; + add_header Content-Security-Policy "script-src 'none'; object-src 'none'; frame-src 'none'; base-uri 'none'; form-action 'none'"; } location / { From 67fb2532c0a545842c79fc799586633d60bd398a Mon Sep 17 00:00:00 2001 From: Jonas Elfering Date: Thu, 15 Oct 2026 11:56:49 +0200 Subject: [PATCH 2/6] docs(security): explain stored asset CSP and CDN requirements --- .../infrastructure/reverse-http-cache.md | 28 +++++++++++++++++++ resources/references/security.md | 16 +++++++++++ 2 files changed, 44 insertions(+) diff --git a/guides/hosting/infrastructure/reverse-http-cache.md b/guides/hosting/infrastructure/reverse-http-cache.md index 74fef21d55..8b917e1937 100644 --- a/guides/hosting/infrastructure/reverse-http-cache.md +++ b/guides/hosting/infrastructure/reverse-http-cache.md @@ -125,6 +125,20 @@ shopware: Make sure to replace the `__XXX__` placeholders with your actual values. +### Varnish static asset CSP + +The provided Varnish configuration sets a Content Security Policy on every response under `/media/`, `/thumbnail/`, `/theme/` and `/bundles/`, regardless of file extension or content type. It applies in `vcl_deliver`, including cache hits and error responses. When updating an existing configuration, merge this rule into its existing `vcl_deliver` subroutine: + +```vcl +sub vcl_deliver { + if (req.url ~ "^/(media|thumbnail|theme|bundles)/") { + set resp.http.Content-Security-Policy = "script-src 'none'; object-src 'none'; frame-src 'none'; base-uri 'none'; form-action 'none'"; + } +} +``` + +Responses outside these asset paths retain their existing policy. HTML applications under `/bundles/` are included: their scripts, embedded documents, base URL overrides and form submissions are blocked. Scripts loaded as resources by application pages remain usable. See [XSS on stored assets](../../../resources/references/security.md#xss-on-stored-assets) for webserver and dedicated CDN requirements. + ### Soft Purge vs Hard Purge The default configuration Varnish uses hard purges, so when you update a product, the page will be removed from the cache and the next request takes longer because the cache is empty. @@ -216,6 +230,20 @@ For manual deployment, you can find the VCL Snippets here: +### Fastly static asset CSP + +The provided Fastly recipes include this rule in `config/fastly/deliver/default.vcl`: + +```vcl +if (req.url.path ~ "^/(media|thumbnail|theme|bundles)/") { + set resp.http.Content-Security-Policy = "script-src 'none'; object-src 'none'; frame-src 'none'; base-uri 'none'; form-action 'none'"; +} +``` + +It applies to every response under these paths, including cached responses, errors and bundled HTML applications, with the same restrictions as the Varnish policy above. `req.url.path` excludes the query string. Existing installations must update and deploy their snippets; enabling Fastly cache invalidation in Shopware does not install this rule. + +For a dedicated asset CDN at a different URL, configure the policy manually on the service that delivers the assets and adjust the paths to its URL layout. See [XSS on stored assets](../../../resources/references/security.md#xss-on-stored-assets). + ### Cache Invalidations The Reverse Proxy Cache shares the same invalidation mechanism as the Object Cache and has the same tags. diff --git a/resources/references/security.md b/resources/references/security.md index 75a90b608c..6e145ffb7d 100644 --- a/resources/references/security.md +++ b/resources/references/security.md @@ -36,6 +36,22 @@ Captchas help to verify the user's humanity and prevent automated bots or script The default policies are configured over the `shopware.security.csp_templates` symfony container parameter and can be adjusted over the container configuration. +## XSS on stored assets + +Stored HTML and SVG files can execute scripts when opened directly in a browser. When these files share an origin with the shop, malicious content can cause cross-site scripting (XSS). Web servers and CDNs often serve stored assets without passing through Shopware, so the application's CSP does not protect these responses. + +Serve stored HTML and SVG assets with the following response header: + +```http +Content-Security-Policy: script-src 'none'; object-src 'none'; frame-src 'none'; base-uri 'none'; form-action 'none' +``` + +This policy blocks scripts, embedded documents, base URL overrides and form submissions while permitting images and styles. It must be present on the asset response, including when a cache serves the file. + +The provided [Apache](./config-reference/server/apache.md), [Nginx](./config-reference/server/nginx.md) and [Caddy](./config-reference/server/caddy.md) configurations include CSP protection for stored HTML and SVG. The [Fastly snippets](../../guides/hosting/infrastructure/reverse-http-cache.md#fastly-static-asset-csp) and [Varnish configuration](../../guides/hosting/infrastructure/reverse-http-cache.md#varnish-static-asset-csp) apply the policy to every response under `/media/`, `/thumbnail/`, `/theme/` and `/bundles/`. This also blocks scripts in bundled HTML applications served through those proxies. Update and deploy existing configurations to receive these protections. + +If you serve static assets from a dedicated CDN using a different CDN URL, configure this response header manually in that CDN. Shopware's application and webserver configuration cannot enforce headers on responses served independently by the CDN. Match the asset paths used by your CDN, including any path prefix, and verify the header on both cache hits and misses. A separate CDN URL does not replace CSP protection for active documents served from it. + ## File access Shopware 6 stores and processes a wide variety of files. This goes from product images or videos to generated documents such as invoices or delivery notes. This data should be stored securely, and backups should be generated regularly. For more information, refer to [File system](../../guides/hosting/infrastructure/filesystem) From dc12427e4b094f550d942e7b969f01acf4b6cd02 Mon Sep 17 00:00:00 2001 From: Jonas Elfering Date: Thu, 15 Oct 2026 13:00:52 +0200 Subject: [PATCH 3/6] docs(security): consolidate proxy CSP guidance for media assets --- .../infrastructure/reverse-http-cache.md | 34 ++++--------------- resources/references/security.md | 2 +- 2 files changed, 7 insertions(+), 29 deletions(-) diff --git a/guides/hosting/infrastructure/reverse-http-cache.md b/guides/hosting/infrastructure/reverse-http-cache.md index 8b917e1937..0394c1b0c2 100644 --- a/guides/hosting/infrastructure/reverse-http-cache.md +++ b/guides/hosting/infrastructure/reverse-http-cache.md @@ -125,20 +125,6 @@ shopware: Make sure to replace the `__XXX__` placeholders with your actual values. -### Varnish static asset CSP - -The provided Varnish configuration sets a Content Security Policy on every response under `/media/`, `/thumbnail/`, `/theme/` and `/bundles/`, regardless of file extension or content type. It applies in `vcl_deliver`, including cache hits and error responses. When updating an existing configuration, merge this rule into its existing `vcl_deliver` subroutine: - -```vcl -sub vcl_deliver { - if (req.url ~ "^/(media|thumbnail|theme|bundles)/") { - set resp.http.Content-Security-Policy = "script-src 'none'; object-src 'none'; frame-src 'none'; base-uri 'none'; form-action 'none'"; - } -} -``` - -Responses outside these asset paths retain their existing policy. HTML applications under `/bundles/` are included: their scripts, embedded documents, base URL overrides and form submissions are blocked. Scripts loaded as resources by application pages remain usable. See [XSS on stored assets](../../../resources/references/security.md#xss-on-stored-assets) for webserver and dedicated CDN requirements. - ### Soft Purge vs Hard Purge The default configuration Varnish uses hard purges, so when you update a product, the page will be removed from the cache and the next request takes longer because the cache is empty. @@ -178,6 +164,12 @@ If you don't see the `Cache-Control: public` header or the `Xkey` header, you ne For more details, please refer to the [Varnish documentation](https://www.varnish-software.com/developers/tutorials/logging-cache-hits-misses-varnish/) on logging cache hits and misses. +## Static asset CSP + +The provided [Varnish configuration](#configure-varnish) and [Fastly VCL snippets](#fastly-vcl-snippets) apply a Content Security Policy to every response under `/media/` and `/thumbnail/`, regardless of file extension or content type, including cache hits and errors. The policy blocks scripts, embedded documents, base URL overrides and form submissions. Responses outside these paths retain their existing policy. + +Update and deploy existing configurations or snippets to receive this protection. See [XSS on stored assets](../../../resources/references/security.md#xss-on-stored-assets) for the policy and security requirements. + ## Configure Fastly Fastly is supported since Shopware 6.4.11.0 is out-of-the-box with some configurations. @@ -230,20 +222,6 @@ For manual deployment, you can find the VCL Snippets here: -### Fastly static asset CSP - -The provided Fastly recipes include this rule in `config/fastly/deliver/default.vcl`: - -```vcl -if (req.url.path ~ "^/(media|thumbnail|theme|bundles)/") { - set resp.http.Content-Security-Policy = "script-src 'none'; object-src 'none'; frame-src 'none'; base-uri 'none'; form-action 'none'"; -} -``` - -It applies to every response under these paths, including cached responses, errors and bundled HTML applications, with the same restrictions as the Varnish policy above. `req.url.path` excludes the query string. Existing installations must update and deploy their snippets; enabling Fastly cache invalidation in Shopware does not install this rule. - -For a dedicated asset CDN at a different URL, configure the policy manually on the service that delivers the assets and adjust the paths to its URL layout. See [XSS on stored assets](../../../resources/references/security.md#xss-on-stored-assets). - ### Cache Invalidations The Reverse Proxy Cache shares the same invalidation mechanism as the Object Cache and has the same tags. diff --git a/resources/references/security.md b/resources/references/security.md index 6e145ffb7d..d2cb4cad84 100644 --- a/resources/references/security.md +++ b/resources/references/security.md @@ -48,7 +48,7 @@ Content-Security-Policy: script-src 'none'; object-src 'none'; frame-src 'none'; This policy blocks scripts, embedded documents, base URL overrides and form submissions while permitting images and styles. It must be present on the asset response, including when a cache serves the file. -The provided [Apache](./config-reference/server/apache.md), [Nginx](./config-reference/server/nginx.md) and [Caddy](./config-reference/server/caddy.md) configurations include CSP protection for stored HTML and SVG. The [Fastly snippets](../../guides/hosting/infrastructure/reverse-http-cache.md#fastly-static-asset-csp) and [Varnish configuration](../../guides/hosting/infrastructure/reverse-http-cache.md#varnish-static-asset-csp) apply the policy to every response under `/media/`, `/thumbnail/`, `/theme/` and `/bundles/`. This also blocks scripts in bundled HTML applications served through those proxies. Update and deploy existing configurations to receive these protections. +The provided [Apache](./config-reference/server/apache.md), [Nginx](./config-reference/server/nginx.md) and [Caddy](./config-reference/server/caddy.md) configurations include CSP protection for stored HTML and SVG. The [Fastly and Varnish configurations](../../guides/hosting/infrastructure/reverse-http-cache.md#static-asset-csp) apply the policy to every response under `/media/` and `/thumbnail/`. Update and deploy existing configurations to receive these protections. If you serve static assets from a dedicated CDN using a different CDN URL, configure this response header manually in that CDN. Shopware's application and webserver configuration cannot enforce headers on responses served independently by the CDN. Match the asset paths used by your CDN, including any path prefix, and verify the header on both cache hits and misses. A separate CDN URL does not replace CSP protection for active documents served from it. From 73b47ba3688fe62534e7953f28a007a49435374f Mon Sep 17 00:00:00 2001 From: Jonas Elfering Date: Thu, 15 Oct 2026 13:14:56 +0200 Subject: [PATCH 4/6] docs(security): clarify reverse proxy CSP preservation --- guides/hosting/infrastructure/reverse-http-cache.md | 6 ------ resources/references/security.md | 4 +++- 2 files changed, 3 insertions(+), 7 deletions(-) diff --git a/guides/hosting/infrastructure/reverse-http-cache.md b/guides/hosting/infrastructure/reverse-http-cache.md index 0394c1b0c2..74fef21d55 100644 --- a/guides/hosting/infrastructure/reverse-http-cache.md +++ b/guides/hosting/infrastructure/reverse-http-cache.md @@ -164,12 +164,6 @@ If you don't see the `Cache-Control: public` header or the `Xkey` header, you ne For more details, please refer to the [Varnish documentation](https://www.varnish-software.com/developers/tutorials/logging-cache-hits-misses-varnish/) on logging cache hits and misses. -## Static asset CSP - -The provided [Varnish configuration](#configure-varnish) and [Fastly VCL snippets](#fastly-vcl-snippets) apply a Content Security Policy to every response under `/media/` and `/thumbnail/`, regardless of file extension or content type, including cache hits and errors. The policy blocks scripts, embedded documents, base URL overrides and form submissions. Responses outside these paths retain their existing policy. - -Update and deploy existing configurations or snippets to receive this protection. See [XSS on stored assets](../../../resources/references/security.md#xss-on-stored-assets) for the policy and security requirements. - ## Configure Fastly Fastly is supported since Shopware 6.4.11.0 is out-of-the-box with some configurations. diff --git a/resources/references/security.md b/resources/references/security.md index d2cb4cad84..069b941328 100644 --- a/resources/references/security.md +++ b/resources/references/security.md @@ -48,7 +48,9 @@ Content-Security-Policy: script-src 'none'; object-src 'none'; frame-src 'none'; This policy blocks scripts, embedded documents, base URL overrides and form submissions while permitting images and styles. It must be present on the asset response, including when a cache serves the file. -The provided [Apache](./config-reference/server/apache.md), [Nginx](./config-reference/server/nginx.md) and [Caddy](./config-reference/server/caddy.md) configurations include CSP protection for stored HTML and SVG. The [Fastly and Varnish configurations](../../guides/hosting/infrastructure/reverse-http-cache.md#static-asset-csp) apply the policy to every response under `/media/` and `/thumbnail/`. Update and deploy existing configurations to receive these protections. +The provided [Apache](./config-reference/server/apache.md), [Nginx](./config-reference/server/nginx.md) and [Caddy](./config-reference/server/caddy.md) configurations include CSP protection for stored HTML and SVG. Update and deploy existing configurations to receive these protections. + +When using a [reverse proxy](../../guides/hosting/infrastructure/reverse-http-cache.md), ensure that it preserves the `Content-Security-Policy` header from the origin server, including on cached responses. Shopware's default Fastly and Varnish configurations preserve this header. If you serve static assets from a dedicated CDN using a different CDN URL, configure this response header manually in that CDN. Shopware's application and webserver configuration cannot enforce headers on responses served independently by the CDN. Match the asset paths used by your CDN, including any path prefix, and verify the header on both cache hits and misses. A separate CDN URL does not replace CSP protection for active documents served from it. From 31c9c9314c213bd2b5dab2262dac59d58996ed93 Mon Sep 17 00:00:00 2001 From: Jonas Elfering Date: Thu, 15 Oct 2026 13:22:24 +0200 Subject: [PATCH 5/6] docs(security): simplify CDN header guidance --- resources/references/security.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/resources/references/security.md b/resources/references/security.md index 069b941328..165367ef4a 100644 --- a/resources/references/security.md +++ b/resources/references/security.md @@ -52,7 +52,7 @@ The provided [Apache](./config-reference/server/apache.md), [Nginx](./config-ref When using a [reverse proxy](../../guides/hosting/infrastructure/reverse-http-cache.md), ensure that it preserves the `Content-Security-Policy` header from the origin server, including on cached responses. Shopware's default Fastly and Varnish configurations preserve this header. -If you serve static assets from a dedicated CDN using a different CDN URL, configure this response header manually in that CDN. Shopware's application and webserver configuration cannot enforce headers on responses served independently by the CDN. Match the asset paths used by your CDN, including any path prefix, and verify the header on both cache hits and misses. A separate CDN URL does not replace CSP protection for active documents served from it. +If you serve static assets from a dedicated CDN using a different CDN URL, configure this response header manually in that CDN. Shopware's application and webserver configuration cannot enforce headers on responses served independently by the CDN. Ensure that your CDN includes this header when serving stored HTML and SVG files, including cached responses. A separate CDN URL does not replace CSP protection for active documents served from it. ## File access From e072c53f9a0a886b57d857288862a294e380ac0e Mon Sep 17 00:00:00 2001 From: Jonas Elfering Date: Thu, 15 Oct 2026 13:27:17 +0200 Subject: [PATCH 6/6] docs(hosting): keep CSP additions in server config examples --- .../config-reference/server/apache.md | 29 +++++-------------- .../config-reference/server/caddy.md | 4 --- .../config-reference/server/nginx.md | 4 --- 3 files changed, 7 insertions(+), 30 deletions(-) diff --git a/resources/references/config-reference/server/apache.md b/resources/references/config-reference/server/apache.md index 836718c457..d0f6f91136 100644 --- a/resources/references/config-reference/server/apache.md +++ b/resources/references/config-reference/server/apache.md @@ -14,31 +14,16 @@ The document root must always point to the public folder, to ensure all function AllowOverride All Order allow,deny allow from all + + + Header set Content-Security-Policy "script-src 'none'; object-src 'none'; frame-src 'none'; base-uri 'none'; form-action 'none'" "expr=-f %{REQUEST_FILENAME} && %{REQUEST_URI} =~ m#^/(media|thumbnail)/.*[.](?i:html)$#" + + Header set Content-Security-Policy "script-src 'none'; object-src 'none'; frame-src 'none'; base-uri 'none'; form-action 'none'" + + ErrorLog ${APACHE_LOG_DIR}/shopware.error.log CustomLog ${APACHE_LOG_DIR}/shopware.access.log combined ``` - -Enable `mod_rewrite` and `mod_headers`, and deploy the current `public/.htaccess` from the Shopware template. -The following additions restrict existing HTML files under `media/` and `thumbnail/`, and apply the same policy to SVG files. -Place the rewrite condition and rule before the existing rule that serves files directly; keep the header directives in the `mod_headers` block. - -```apache - - RewriteEngine On - RewriteCond %{REQUEST_FILENAME} -f - RewriteRule ^(?:media|thumbnail)/.*\.(?i:html)$ - [E=SHOPWARE_STATIC_HTML:1] - - - - Header set Content-Security-Policy "script-src 'none'; object-src 'none'; frame-src 'none'; base-uri 'none'; form-action 'none'" env=SHOPWARE_STATIC_HTML - - Header set Content-Security-Policy "script-src 'none'; object-src 'none'; frame-src 'none'; base-uri 'none'; form-action 'none'" - - -``` - -These rules leave application-rendered HTML and bundled HTML applications unchanged. -Custom static documents must work without scripts, embedded documents, base URL overrides or form submissions; images and styles remain permitted. diff --git a/resources/references/config-reference/server/caddy.md b/resources/references/config-reference/server/caddy.md index 9d696a78f2..4ca6bb8f13 100644 --- a/resources/references/config-reference/server/caddy.md +++ b/resources/references/config-reference/server/caddy.md @@ -1,9 +1,5 @@ # Caddy -The static-file policy below restricts existing SVG files and HTML files under `media/` and `thumbnail/`. -Application-rendered HTML and bundled HTML applications retain their own response policies. -Custom static documents must work without scripts, embedded documents, base URL overrides or form submissions; images and styles remain permitted. - ```text mydomain.com { header { diff --git a/resources/references/config-reference/server/nginx.md b/resources/references/config-reference/server/nginx.md index 35567df448..9f4c1055c6 100644 --- a/resources/references/config-reference/server/nginx.md +++ b/resources/references/config-reference/server/nginx.md @@ -4,10 +4,6 @@ The document root must always point to the public folder, to ensure all functionality works. ::: -The static-file policy below restricts SVG files and HTML files under `media/` and `thumbnail/`. -Missing HTML media files return 404; application-rendered HTML and bundled HTML applications retain their own response policies. -Custom static documents must work without scripts, embedded documents, base URL overrides or form submissions; images and styles remain permitted. - ```text server { listen 80;