From 5589b3f73766b3136aa9c5d503eeb94286d7a9f5 Mon Sep 17 00:00:00 2001 From: Jonas Elfering Date: Thu, 15 Oct 2026 10:27:25 +0200 Subject: [PATCH 1/6] docs(hosting): align static asset CSP on 6.6 --- .../config-reference/server/apache.md | 22 +++++++++++++++++++ .../config-reference/server/caddy.md | 10 ++++++--- .../config-reference/server/nginx.md | 21 +++++++++++++++--- 3 files changed, 47 insertions(+), 6 deletions(-) diff --git a/resources/references/config-reference/server/apache.md b/resources/references/config-reference/server/apache.md index b40222374d..836718c457 100644 --- a/resources/references/config-reference/server/apache.md +++ b/resources/references/config-reference/server/apache.md @@ -20,3 +20,25 @@ The document root must always point to the public folder, to ensure all function CustomLog ${APACHE_LOG_DIR}/shopware.access.log combined ``` + +Enable `mod_rewrite` and `mod_headers`, and deploy the current `public/.htaccess` from the Shopware template. +The following additions restrict existing HTML files under `media/` and `thumbnail/`, and apply the same policy to SVG files. +Place the rewrite condition and rule before the existing rule that serves files directly; keep the header directives in the `mod_headers` block. + +```apache + + RewriteEngine On + RewriteCond %{REQUEST_FILENAME} -f + RewriteRule ^(?:media|thumbnail)/.*\.(?i:html)$ - [E=SHOPWARE_STATIC_HTML:1] + + + + Header set Content-Security-Policy "script-src 'none'; object-src 'none'; frame-src 'none'; base-uri 'none'; form-action 'none'" env=SHOPWARE_STATIC_HTML + + Header set Content-Security-Policy "script-src 'none'; object-src 'none'; frame-src 'none'; base-uri 'none'; form-action 'none'" + + +``` + +These rules leave application-rendered HTML and bundled HTML applications unchanged. +Custom static documents must work without scripts, embedded documents, base URL overrides or form submissions; images and styles remain permitted. diff --git a/resources/references/config-reference/server/caddy.md b/resources/references/config-reference/server/caddy.md index 9db63a85b1..9d696a78f2 100644 --- a/resources/references/config-reference/server/caddy.md +++ b/resources/references/config-reference/server/caddy.md @@ -1,5 +1,9 @@ # Caddy +The static-file policy below restricts existing SVG files and HTML files under `media/` and `thumbnail/`. +Application-rendered HTML and bundled HTML applications retain their own response policies. +Custom static documents must work without scripts, embedded documents, base URL overrides or form submissions; images and styles remain permitted. + ```text mydomain.com { header { @@ -7,12 +11,12 @@ mydomain.com { Referrer-Policy no-referrer-when-downgrade } - @svg { + @staticDocuments { file - path *.svg + path_regexp staticDocuments (?i)([.]svg$|^/(media|thumbnail)/.*[.]html$) } - header @svg Content-Security-Policy "script-src 'none'" + header @staticDocuments Content-Security-Policy "script-src 'none'; object-src 'none'; frame-src 'none'; base-uri 'none'; form-action 'none'" @default { not path /theme/* /media/* /thumbnail/* /bundles/* /css/* /fonts/* /js/* /recovery/* /sitemap/* diff --git a/resources/references/config-reference/server/nginx.md b/resources/references/config-reference/server/nginx.md index a1521c4336..59a08d3771 100644 --- a/resources/references/config-reference/server/nginx.md +++ b/resources/references/config-reference/server/nginx.md @@ -4,6 +4,10 @@ The document root must always point to the public folder, to ensure all functionality works. ::: +The static-file policy below restricts SVG files and HTML files under `media/` and `thumbnail/`. +Missing HTML media files return 404; application-rendered HTML and bundled HTML applications retain their own response policies. +Custom static documents must work without scripts, embedded documents, base URL overrides or form submissions; images and styles remain permitted. + ```text server { listen 80; @@ -47,6 +51,14 @@ server { } } + # Stored HTML must not affect pages rendered by PHP. + location ~* ^/(media|thumbnail)/.*[.]html$ { + try_files $uri =404; + expires 1y; + add_header Cache-Control "public, must-revalidate, proxy-revalidate"; + add_header Content-Security-Policy "script-src 'none'; object-src 'none'; frame-src 'none'; base-uri 'none'; form-action 'none'"; + } + location ~ ^/(theme|media|thumbnail|bundles|css|fonts|js|recovery|sitemap)/ { expires 1y; add_header Cache-Control "public, must-revalidate, proxy-revalidate"; @@ -58,13 +70,13 @@ server { open_file_cache_errors off; location ~* ^.+\.svg { - add_header Content-Security-Policy "script-src 'none'"; + add_header Content-Security-Policy "script-src 'none'; object-src 'none'; frame-src 'none'; base-uri 'none'; form-action 'none'"; add_header Cache-Control "public, must-revalidate, proxy-revalidate"; log_not_found off; } } - location ~* ^.+\.(?:css|cur|js|jpe?g|gif|ico|png|svg|webp|html|woff|woff2|xml)$ { + location ~* ^.+\.(?:css|cur|js|jpe?g|gif|ico|png|webp|html|woff|woff2|xml)$ { expires 1y; add_header Cache-Control "public, must-revalidate, proxy-revalidate"; @@ -85,7 +97,10 @@ server { } location ~* ^.+\.svg$ { - add_header Content-Security-Policy "script-src 'none'"; + try_files $uri /index.php$is_args$args; + expires 1y; + add_header Cache-Control "public, must-revalidate, proxy-revalidate"; + add_header Content-Security-Policy "script-src 'none'; object-src 'none'; frame-src 'none'; base-uri 'none'; form-action 'none'"; } location / { From 10562b0d6c7e5f7da532269d48859be0149ec08d Mon Sep 17 00:00:00 2001 From: Jonas Elfering Date: Thu, 15 Oct 2026 11:56:49 +0200 Subject: [PATCH 2/6] docs(security): explain asset CSP for 6.6 deployments --- .../infrastructure/reverse-http-cache.md | 30 ++++++++++++++++++- resources/references/security.md | 16 ++++++++++ 2 files changed, 45 insertions(+), 1 deletion(-) diff --git a/guides/hosting/infrastructure/reverse-http-cache.md b/guides/hosting/infrastructure/reverse-http-cache.md index a9d550df1e..3026dea012 100644 --- a/guides/hosting/infrastructure/reverse-http-cache.md +++ b/guides/hosting/infrastructure/reverse-http-cache.md @@ -102,10 +102,24 @@ shopware: - 'varnish-host' ``` - + Make sure to replace the `__XXX__` placeholders with your actual values. +### Varnish static asset CSP + +The provided Varnish configuration sets a Content Security Policy on every response under `/media/`, `/thumbnail/`, `/theme/` and `/bundles/`, regardless of file extension or content type. It applies in `vcl_deliver`, including cache hits and error responses. When updating an existing configuration, merge this rule into its existing `vcl_deliver` subroutine: + +```vcl +sub vcl_deliver { + if (req.url ~ "^/(media|thumbnail|theme|bundles)/") { + set resp.http.Content-Security-Policy = "script-src 'none'; object-src 'none'; frame-src 'none'; base-uri 'none'; form-action 'none'"; + } +} +``` + +Responses outside these asset paths retain their existing policy. HTML applications under `/bundles/` are included: their scripts, embedded documents, base URL overrides and form submissions are blocked. Scripts loaded as resources by application pages remain usable. See [XSS on stored assets](../../../resources/references/security.md#xss-on-stored-assets) for webserver and dedicated CDN requirements. + ### Soft Purge vs Hard Purge The default configuration Varnish uses Hard purges, so when you update a product, the page will be removed from the cache and the next request takes longer because the cache is empty. To avoid this, you can use Soft purges. @@ -182,6 +196,20 @@ shopware: soft_purge: '1' ``` +### Fastly static asset CSP + +The provided Fastly recipes include this rule in `config/fastly/deliver/default.vcl`: + +```vcl +if (req.url.path ~ "^/(media|thumbnail|theme|bundles)/") { + set resp.http.Content-Security-Policy = "script-src 'none'; object-src 'none'; frame-src 'none'; base-uri 'none'; form-action 'none'"; +} +``` + +It applies to every response under these paths, including cached responses, errors and bundled HTML applications, with the same restrictions as the Varnish policy above. `req.url.path` excludes the query string. Existing installations must update and deploy their snippets; enabling Fastly cache invalidation in Shopware does not install this rule. + +For a dedicated asset CDN at a different URL, configure the policy manually on the service that delivers the assets and adjust the paths to its URL layout. See [XSS on stored assets](../../../resources/references/security.md#xss-on-stored-assets). + ### Fastly VCL Snippets You can use the [Deployment Helper to automatically deploy Fastly VCL Snippets and keep them up to date](../installation-updates//deployments/deployment-helper.md). diff --git a/resources/references/security.md b/resources/references/security.md index 3f3b64b60f..515df11ece 100644 --- a/resources/references/security.md +++ b/resources/references/security.md @@ -33,6 +33,22 @@ Captchas help to verify the user's humanity and prevent automated bots or script The default policies are configured over the `shopware.security.csp_templates` symfony container parameter and can be adjusted over the container configuration. +## XSS on stored assets + +Stored HTML and SVG files can execute scripts when opened directly in a browser. When these files share an origin with the shop, malicious content can cause cross-site scripting (XSS). Web servers and CDNs often serve stored assets without passing through Shopware, so the application's CSP does not protect these responses. + +Serve stored HTML and SVG assets with the following response header: + +```http +Content-Security-Policy: script-src 'none'; object-src 'none'; frame-src 'none'; base-uri 'none'; form-action 'none' +``` + +This policy blocks scripts, embedded documents, base URL overrides and form submissions while permitting images and styles. It must be present on the asset response, including when a cache serves the file. + +The provided [Apache](./config-reference/server/apache.md), [Nginx](./config-reference/server/nginx.md) and [Caddy](./config-reference/server/caddy.md) configurations include CSP protection for stored HTML and SVG. The [Fastly snippets](../../guides/hosting/infrastructure/reverse-http-cache.md#fastly-static-asset-csp) and [Varnish configuration](../../guides/hosting/infrastructure/reverse-http-cache.md#varnish-static-asset-csp) apply the policy to every response under `/media/`, `/thumbnail/`, `/theme/` and `/bundles/`. This also blocks scripts in bundled HTML applications served through those proxies. Update and deploy existing configurations to receive these protections. + +If you serve static assets from a dedicated CDN using a different CDN URL, configure this response header manually in that CDN. Shopware's application and webserver configuration cannot enforce headers on responses served independently by the CDN. Match the asset paths used by your CDN, including any path prefix, and verify the header on both cache hits and misses. A separate CDN URL does not replace CSP protection for active documents served from it. + ## File access Shopware 6 stores and processes a wide variety of files. This goes from product images or videos to generated documents such as invoices or delivery notes. This data should be stored securely, and backups should be generated regularly. For more information, refer to [File system](../../guides/hosting/infrastructure/filesystem) From 586c5a3c3c9479deec36c9f6c7fd9b4b0022dfb7 Mon Sep 17 00:00:00 2001 From: Jonas Elfering Date: Thu, 15 Oct 2026 13:00:52 +0200 Subject: [PATCH 3/6] docs(security): consolidate proxy CSP guidance for media assets --- .../infrastructure/reverse-http-cache.md | 34 ++++--------------- resources/references/security.md | 2 +- 2 files changed, 7 insertions(+), 29 deletions(-) diff --git a/guides/hosting/infrastructure/reverse-http-cache.md b/guides/hosting/infrastructure/reverse-http-cache.md index 3026dea012..17d67ab191 100644 --- a/guides/hosting/infrastructure/reverse-http-cache.md +++ b/guides/hosting/infrastructure/reverse-http-cache.md @@ -106,20 +106,6 @@ shopware: Make sure to replace the `__XXX__` placeholders with your actual values. -### Varnish static asset CSP - -The provided Varnish configuration sets a Content Security Policy on every response under `/media/`, `/thumbnail/`, `/theme/` and `/bundles/`, regardless of file extension or content type. It applies in `vcl_deliver`, including cache hits and error responses. When updating an existing configuration, merge this rule into its existing `vcl_deliver` subroutine: - -```vcl -sub vcl_deliver { - if (req.url ~ "^/(media|thumbnail|theme|bundles)/") { - set resp.http.Content-Security-Policy = "script-src 'none'; object-src 'none'; frame-src 'none'; base-uri 'none'; form-action 'none'"; - } -} -``` - -Responses outside these asset paths retain their existing policy. HTML applications under `/bundles/` are included: their scripts, embedded documents, base URL overrides and form submissions are blocked. Scripts loaded as resources by application pages remain usable. See [XSS on stored assets](../../../resources/references/security.md#xss-on-stored-assets) for webserver and dedicated CDN requirements. - ### Soft Purge vs Hard Purge The default configuration Varnish uses Hard purges, so when you update a product, the page will be removed from the cache and the next request takes longer because the cache is empty. To avoid this, you can use Soft purges. @@ -155,6 +141,12 @@ If you don't see the `Cache-Control: public` header or the `Xkey` header, you ne For more details, please refer to the [Varnish documentation](https://www.varnish-software.com/developers/tutorials/logging-cache-hits-misses-varnish/) on logging cache hits and misses. +## Static asset CSP + +The provided [Varnish configuration](#configure-varnish) and [Fastly VCL snippets](#fastly-vcl-snippets) apply a Content Security Policy to every response under `/media/` and `/thumbnail/`, regardless of file extension or content type, including cache hits and errors. The policy blocks scripts, embedded documents, base URL overrides and form submissions. Responses outside these paths retain their existing policy. + +Update and deploy existing configurations or snippets to receive this protection. See [XSS on stored assets](../../../resources/references/security.md#xss-on-stored-assets) for the policy and security requirements. + ## Configure Fastly Fastly is supported since Shopware 6.4.11.0 is out-of-the-box with some configurations. To enable it, we need to create a new file in `config/packages/storefront.yaml` @@ -196,20 +188,6 @@ shopware: soft_purge: '1' ``` -### Fastly static asset CSP - -The provided Fastly recipes include this rule in `config/fastly/deliver/default.vcl`: - -```vcl -if (req.url.path ~ "^/(media|thumbnail|theme|bundles)/") { - set resp.http.Content-Security-Policy = "script-src 'none'; object-src 'none'; frame-src 'none'; base-uri 'none'; form-action 'none'"; -} -``` - -It applies to every response under these paths, including cached responses, errors and bundled HTML applications, with the same restrictions as the Varnish policy above. `req.url.path` excludes the query string. Existing installations must update and deploy their snippets; enabling Fastly cache invalidation in Shopware does not install this rule. - -For a dedicated asset CDN at a different URL, configure the policy manually on the service that delivers the assets and adjust the paths to its URL layout. See [XSS on stored assets](../../../resources/references/security.md#xss-on-stored-assets). - ### Fastly VCL Snippets You can use the [Deployment Helper to automatically deploy Fastly VCL Snippets and keep them up to date](../installation-updates//deployments/deployment-helper.md). diff --git a/resources/references/security.md b/resources/references/security.md index 515df11ece..77f3b80837 100644 --- a/resources/references/security.md +++ b/resources/references/security.md @@ -45,7 +45,7 @@ Content-Security-Policy: script-src 'none'; object-src 'none'; frame-src 'none'; This policy blocks scripts, embedded documents, base URL overrides and form submissions while permitting images and styles. It must be present on the asset response, including when a cache serves the file. -The provided [Apache](./config-reference/server/apache.md), [Nginx](./config-reference/server/nginx.md) and [Caddy](./config-reference/server/caddy.md) configurations include CSP protection for stored HTML and SVG. The [Fastly snippets](../../guides/hosting/infrastructure/reverse-http-cache.md#fastly-static-asset-csp) and [Varnish configuration](../../guides/hosting/infrastructure/reverse-http-cache.md#varnish-static-asset-csp) apply the policy to every response under `/media/`, `/thumbnail/`, `/theme/` and `/bundles/`. This also blocks scripts in bundled HTML applications served through those proxies. Update and deploy existing configurations to receive these protections. +The provided [Apache](./config-reference/server/apache.md), [Nginx](./config-reference/server/nginx.md) and [Caddy](./config-reference/server/caddy.md) configurations include CSP protection for stored HTML and SVG. The [Fastly and Varnish configurations](../../guides/hosting/infrastructure/reverse-http-cache.md#static-asset-csp) apply the policy to every response under `/media/` and `/thumbnail/`. Update and deploy existing configurations to receive these protections. If you serve static assets from a dedicated CDN using a different CDN URL, configure this response header manually in that CDN. Shopware's application and webserver configuration cannot enforce headers on responses served independently by the CDN. Match the asset paths used by your CDN, including any path prefix, and verify the header on both cache hits and misses. A separate CDN URL does not replace CSP protection for active documents served from it. From 3ec0b4fa382f71b4b1e35221a229024519dcde43 Mon Sep 17 00:00:00 2001 From: Jonas Elfering Date: Thu, 15 Oct 2026 13:14:56 +0200 Subject: [PATCH 4/6] docs(security): clarify reverse proxy CSP preservation --- guides/hosting/infrastructure/reverse-http-cache.md | 8 +------- resources/references/security.md | 4 +++- 2 files changed, 4 insertions(+), 8 deletions(-) diff --git a/guides/hosting/infrastructure/reverse-http-cache.md b/guides/hosting/infrastructure/reverse-http-cache.md index 17d67ab191..a9d550df1e 100644 --- a/guides/hosting/infrastructure/reverse-http-cache.md +++ b/guides/hosting/infrastructure/reverse-http-cache.md @@ -102,7 +102,7 @@ shopware: - 'varnish-host' ``` - + Make sure to replace the `__XXX__` placeholders with your actual values. @@ -141,12 +141,6 @@ If you don't see the `Cache-Control: public` header or the `Xkey` header, you ne For more details, please refer to the [Varnish documentation](https://www.varnish-software.com/developers/tutorials/logging-cache-hits-misses-varnish/) on logging cache hits and misses. -## Static asset CSP - -The provided [Varnish configuration](#configure-varnish) and [Fastly VCL snippets](#fastly-vcl-snippets) apply a Content Security Policy to every response under `/media/` and `/thumbnail/`, regardless of file extension or content type, including cache hits and errors. The policy blocks scripts, embedded documents, base URL overrides and form submissions. Responses outside these paths retain their existing policy. - -Update and deploy existing configurations or snippets to receive this protection. See [XSS on stored assets](../../../resources/references/security.md#xss-on-stored-assets) for the policy and security requirements. - ## Configure Fastly Fastly is supported since Shopware 6.4.11.0 is out-of-the-box with some configurations. To enable it, we need to create a new file in `config/packages/storefront.yaml` diff --git a/resources/references/security.md b/resources/references/security.md index 77f3b80837..d632ebeb0f 100644 --- a/resources/references/security.md +++ b/resources/references/security.md @@ -45,7 +45,9 @@ Content-Security-Policy: script-src 'none'; object-src 'none'; frame-src 'none'; This policy blocks scripts, embedded documents, base URL overrides and form submissions while permitting images and styles. It must be present on the asset response, including when a cache serves the file. -The provided [Apache](./config-reference/server/apache.md), [Nginx](./config-reference/server/nginx.md) and [Caddy](./config-reference/server/caddy.md) configurations include CSP protection for stored HTML and SVG. The [Fastly and Varnish configurations](../../guides/hosting/infrastructure/reverse-http-cache.md#static-asset-csp) apply the policy to every response under `/media/` and `/thumbnail/`. Update and deploy existing configurations to receive these protections. +The provided [Apache](./config-reference/server/apache.md), [Nginx](./config-reference/server/nginx.md) and [Caddy](./config-reference/server/caddy.md) configurations include CSP protection for stored HTML and SVG. Update and deploy existing configurations to receive these protections. + +When using a [reverse proxy](../../guides/hosting/infrastructure/reverse-http-cache.md), ensure that it preserves the `Content-Security-Policy` header from the origin server, including on cached responses. Shopware's default Fastly and Varnish configurations preserve this header. If you serve static assets from a dedicated CDN using a different CDN URL, configure this response header manually in that CDN. Shopware's application and webserver configuration cannot enforce headers on responses served independently by the CDN. Match the asset paths used by your CDN, including any path prefix, and verify the header on both cache hits and misses. A separate CDN URL does not replace CSP protection for active documents served from it. From 65c30bc15e6418e5281d6d8cabc1d4fd2aabb1dd Mon Sep 17 00:00:00 2001 From: Jonas Elfering Date: Thu, 15 Oct 2026 13:22:24 +0200 Subject: [PATCH 5/6] docs(security): simplify CDN header guidance --- resources/references/security.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/resources/references/security.md b/resources/references/security.md index d632ebeb0f..0eda9adbf2 100644 --- a/resources/references/security.md +++ b/resources/references/security.md @@ -49,7 +49,7 @@ The provided [Apache](./config-reference/server/apache.md), [Nginx](./config-ref When using a [reverse proxy](../../guides/hosting/infrastructure/reverse-http-cache.md), ensure that it preserves the `Content-Security-Policy` header from the origin server, including on cached responses. Shopware's default Fastly and Varnish configurations preserve this header. -If you serve static assets from a dedicated CDN using a different CDN URL, configure this response header manually in that CDN. Shopware's application and webserver configuration cannot enforce headers on responses served independently by the CDN. Match the asset paths used by your CDN, including any path prefix, and verify the header on both cache hits and misses. A separate CDN URL does not replace CSP protection for active documents served from it. +If you serve static assets from a dedicated CDN using a different CDN URL, configure this response header manually in that CDN. Shopware's application and webserver configuration cannot enforce headers on responses served independently by the CDN. Ensure that your CDN includes this header when serving stored HTML and SVG files, including cached responses. A separate CDN URL does not replace CSP protection for active documents served from it. ## File access From 16555fda2cbdbf92d0e6ba23905608aabd764f6c Mon Sep 17 00:00:00 2001 From: Jonas Elfering Date: Thu, 15 Oct 2026 13:27:17 +0200 Subject: [PATCH 6/6] docs(hosting): keep CSP additions in server config examples --- .../config-reference/server/apache.md | 29 +++++-------------- .../config-reference/server/caddy.md | 4 --- .../config-reference/server/nginx.md | 4 --- 3 files changed, 7 insertions(+), 30 deletions(-) diff --git a/resources/references/config-reference/server/apache.md b/resources/references/config-reference/server/apache.md index 836718c457..d0f6f91136 100644 --- a/resources/references/config-reference/server/apache.md +++ b/resources/references/config-reference/server/apache.md @@ -14,31 +14,16 @@ The document root must always point to the public folder, to ensure all function AllowOverride All Order allow,deny allow from all + + + Header set Content-Security-Policy "script-src 'none'; object-src 'none'; frame-src 'none'; base-uri 'none'; form-action 'none'" "expr=-f %{REQUEST_FILENAME} && %{REQUEST_URI} =~ m#^/(media|thumbnail)/.*[.](?i:html)$#" + + Header set Content-Security-Policy "script-src 'none'; object-src 'none'; frame-src 'none'; base-uri 'none'; form-action 'none'" + + ErrorLog ${APACHE_LOG_DIR}/shopware.error.log CustomLog ${APACHE_LOG_DIR}/shopware.access.log combined ``` - -Enable `mod_rewrite` and `mod_headers`, and deploy the current `public/.htaccess` from the Shopware template. -The following additions restrict existing HTML files under `media/` and `thumbnail/`, and apply the same policy to SVG files. -Place the rewrite condition and rule before the existing rule that serves files directly; keep the header directives in the `mod_headers` block. - -```apache - - RewriteEngine On - RewriteCond %{REQUEST_FILENAME} -f - RewriteRule ^(?:media|thumbnail)/.*\.(?i:html)$ - [E=SHOPWARE_STATIC_HTML:1] - - - - Header set Content-Security-Policy "script-src 'none'; object-src 'none'; frame-src 'none'; base-uri 'none'; form-action 'none'" env=SHOPWARE_STATIC_HTML - - Header set Content-Security-Policy "script-src 'none'; object-src 'none'; frame-src 'none'; base-uri 'none'; form-action 'none'" - - -``` - -These rules leave application-rendered HTML and bundled HTML applications unchanged. -Custom static documents must work without scripts, embedded documents, base URL overrides or form submissions; images and styles remain permitted. diff --git a/resources/references/config-reference/server/caddy.md b/resources/references/config-reference/server/caddy.md index 9d696a78f2..4ca6bb8f13 100644 --- a/resources/references/config-reference/server/caddy.md +++ b/resources/references/config-reference/server/caddy.md @@ -1,9 +1,5 @@ # Caddy -The static-file policy below restricts existing SVG files and HTML files under `media/` and `thumbnail/`. -Application-rendered HTML and bundled HTML applications retain their own response policies. -Custom static documents must work without scripts, embedded documents, base URL overrides or form submissions; images and styles remain permitted. - ```text mydomain.com { header { diff --git a/resources/references/config-reference/server/nginx.md b/resources/references/config-reference/server/nginx.md index 59a08d3771..5b49327c8a 100644 --- a/resources/references/config-reference/server/nginx.md +++ b/resources/references/config-reference/server/nginx.md @@ -4,10 +4,6 @@ The document root must always point to the public folder, to ensure all functionality works. ::: -The static-file policy below restricts SVG files and HTML files under `media/` and `thumbnail/`. -Missing HTML media files return 404; application-rendered HTML and bundled HTML applications retain their own response policies. -Custom static documents must work without scripts, embedded documents, base URL overrides or form submissions; images and styles remain permitted. - ```text server { listen 80;