From ef76cd42761fa56f7039ca7537a242c24cb54648 Mon Sep 17 00:00:00 2001
From: a2nr <a2nr@mekatronika.ac.id>
Date: Sun, 13 Sep 2026 10:14:34 +0700
Subject: [PATCH] fix(nginx): add COEP and CORP headers for crossOriginIsolated
 iframe embedding

---
 docker/nginx.conf | 19 +++++++++++++++++--
 1 file changed, 17 insertions(+), 2 deletions(-)

diff --git a/docker/nginx.conf b/docker/nginx.conf
index 6b903097..21dcb203 100644
--- a/docker/nginx.conf
+++ b/docker/nginx.conf
@@ -18,17 +18,23 @@ server {
     add_header X-Content-Type-Options "nosniff" always;
     add_header X-XSS-Protection "1; mode=block" always;
     add_header Referrer-Policy "strict-origin-when-cross-origin" always;
+    add_header Cross-Origin-Embedder-Policy "credentialless" always;
+    add_header Cross-Origin-Resource-Policy "cross-origin" always;
 
     # SEO crawler files — never cache so Googlebot always gets the latest version
     location = /sitemap.xml {
         try_files $uri =404;
         add_header Cache-Control "no-cache, must-revalidate";
         add_header X-Content-Type-Options "nosniff" always;
+        add_header Cross-Origin-Embedder-Policy "credentialless" always;
+        add_header Cross-Origin-Resource-Policy "cross-origin" always;
     }
 
     location = /robots.txt {
         try_files $uri =404;
         add_header Cache-Control "no-cache, must-revalidate";
+        add_header Cross-Origin-Embedder-Policy "credentialless" always;
+        add_header Cross-Origin-Resource-Policy "cross-origin" always;
     }
 
     # Health check endpoint
@@ -63,17 +69,23 @@ server {
         proxy_set_header X-Forwarded-Proto $scheme;
         proxy_read_timeout 600s;
         proxy_connect_timeout 75s;
+        add_header Cross-Origin-Embedder-Policy "credentialless" always;
+        add_header Cross-Origin-Resource-Policy "cross-origin" always;
     }
 
-    # Cache static assets with content-hash filenames (js/css/fonts/images)
-    location ~* \.(js|css|woff|woff2|ttf|eot)$ {
+    # Cache static assets with content-hash filenames (js/css/fonts/images/wasm)
+    location ~* \.(js|css|woff|woff2|ttf|eot|wasm)$ {
         expires 1y;
         add_header Cache-Control "public, immutable";
+        add_header Cross-Origin-Embedder-Policy "credentialless" always;
+        add_header Cross-Origin-Resource-Policy "cross-origin" always;
     }
 
     location ~* \.(png|jpg|jpeg|gif|ico|svg|webp)$ {
         expires 30d;
         add_header Cache-Control "public";
+        add_header Cross-Origin-Embedder-Policy "credentialless" always;
+        add_header Cross-Origin-Resource-Policy "cross-origin" always;
     }
 
     # Gzip compression
@@ -90,5 +102,8 @@ server {
 
     location / {
         try_files $uri /index.html;
+        add_header X-Frame-Options "SAMEORIGIN" always;
+        add_header Cross-Origin-Embedder-Policy "credentialless" always;
+        add_header Cross-Origin-Resource-Policy "cross-origin" always;
     }
 }