awkawb/invoiceninja-nixos
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

nixos-module: remove proxy-level CORS headers

Browse Source 
Laravel's own CORS middleware already sends a complete, correct set of
Access-Control-* headers on every response. The nginx and caddy vhost
configs were additionally setting a second, static set of the same
headers, producing duplicates with conflicting values (e.g. two
Access-Control-Allow-Methods headers, one "*" and one the app's real
list). Browsers reject responses with duplicate/conflicting CORS
headers - curl-based checks never noticed since only browsers enforce
CORS header validation, but it broke real browser usage (login/API
calls failing silently).

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
This commit is contained in:
awkawb
2026-09-26 14:35:53 -04:00
co-authored by Claude Sonnet 5
parent 4c97391a33
commit a71ccc87bb
2 changed files with 5 additions and 17 deletions
Download Patch File Download Diff File Expand all files Collapse all files
CLAUDE.md
+5 -1
View File
@@ -107,7 +107,11 @@ expect Nix to report the correct hash on a failed build (or use `nix-prefetch`/`
It's added to `environment.systemPackages`, so it's the normal way to run artisan commands
(`migrate`, `queue:work`, `ninja:create-account`, etc.) by hand on a deployed system.
- Both `nginx` and `caddy` proxy backends are supported (`proxy.server`), each independently duplicating the
CORS headers and PHP-FPM passthrough config — if changing one, check whether the other needs the same change.
PHP-FPM passthrough config — if changing one, check whether the other needs the same change. Neither sets
CORS headers itself: Laravel's own CORS middleware already sends a complete set on every response, and an
earlier version of this module additionally set a second, static set of `Access-Control-*` headers at the
proxy level, which browsers reject as conflicting duplicates (server-to-server/curl checks don't notice,
since only browsers enforce CORS header validation).
- Chromium is required at runtime for PDF generation (`PDF_GENERATOR=snappdf`, `SNAPPDF_CHROMIUM_PATH`) and is
added to the PHP-FPM and data-setup services' `path`.
nixos-module/invoiceninja.nix
-16
View File
@@ -526,14 +526,6 @@ in
if (!-e $request_filename) {
rewrite ^(.+)$ /index.php?q= last;
}
add_header 'Access-Control-Allow-Origin' '*';
add_header 'Access-Control-Allow-Methods' '*';
add_header 'Access-Control-Max-Age' 0;
add_header 'Content-Length' 0;
add_header 'Access-Control-Allow-Headers' 'X-API-COMPANY-KEY,X-API-SECRET,X-API-TOKEN,X-API-PASSWORD,DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Disposition,Content-Type,Range,X-CSRF-TOKEN,X-XSRF-TOKEN,X-LIVEWIRE';
add_header 'Access-Control-Expose-Headers' 'X-APP-VERSION,X-MINIMUM-CLIENT-VERSION,X-CSRF-TOKEN,X-XSRF-TOKEN,X-LIVEWIRE';
add_header 'Access-Control-Allow-Credentials' false;
'';
}
(lib.mkIf (cfg.hostname != "localhost") {
@@ -569,14 +561,6 @@ in
encode zstd gzip
root ${invoiceninja}/public
php_fastcgi unix/${config.services.phpfpm.pools.invoiceninja.socket}
header {
Access-Control-Allow-Origin "*"
Access-Control-Allow-Methods "*"
Access-Control-Max-Age "0"
Access-Control-Allow-Headers "X-API-COMPANY-KEY,X-API-SECRET,X-API-TOKEN,X-API-PASSWORD,DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Disposition,Content-Type,Range,X-CSRF-TOKEN,X-XSRF-TOKEN,X-LIVEWIRE"
Access-Control-Expose-Headers "X-APP-VERSION,X-MINIMUM-CLIENT-VERSION,X-CSRF-TOKEN,X-XSRF-TOKEN,X-LIVEWIRE"
Access-Control-Allow-Credentials false
}
file_server
'';
}