8000 Performance improvements (2/3) to example-advanced.nginx.conf by nisbet-hubbard · Pull Request #2005 · cryptpad/cryptpad · GitHub
[go: up one dir, main page]
Skip to content

Performance improvements (2/3) to example-advanced.nginx.conf #2005

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Merged
mathilde-cryptpad merged 4 commits into from
Oct 22, 2025
Merged

Performance improvements (2/3) to example-advanced.nginx.conf #2005

mathilde-cryptpad merged 4 commits into from
Oct 22, 2025

Conversation

@nisbet-hubbard
Copy link
Contributor
@nisbet-hubbard nisbet-hubbard commented Jul 19, 2025 •
edited
Loading

This is the second of three PRs to close #1704. The patch is separated out to make testing easier. The third part will cover load balancing (between workers/cores).

This patch removes two deprecated security headers and limits the use of the CSP header to dynamic assets:

  1. The X-XSS-Protection header has been deprecated in favour of Content-Security-Policy, and support for it was dropped in all browsers. https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Headers/X-XSS-Protection
  2. Google’s FLoC trials ended in 2021 and were replaced by Topics API, so Permissions-Policy interest-cohort=(); no longer serves any purpose. https://developer.chrome.com/origintrials/#/view_trial/213920982300098561 https://blog.google/products/chrome/get-know-new-topics-api-privacy-sandbox/
  3. The longish Content-Security-Policy header is currently set for all assets, but is really relevant only to the ones that can execute JavaScript. So I moved it into the location blocks where it’s actually needed. Because doing so overwrites other inherited headers, however, I had to duplicate those headers inside the blocks as well. One may argue that keeping the config concise is more important than shaving a few ~700 bytes from each static asset by omitting the CSP header, so feel free to not go with this optimisation.

@mathilde-cryptpad mathilde-cryptpad self-assigned this Jul 22, 2025
@mathilde-cryptpad mathilde-cryptpad added Reverse proxy Web server or reverse proxy issues Ready to Review This PR is ready to be checked by another team member labels Jul 22, 2025
@mathilde-cryptpad mathilde-cryptpad merged commit de2e740 into cryptpad:main Oct 22, 2025
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

@mathilde-cryptpad mathilde-cryptpad

Labels

Ready to Review This PR is ready to be checked by another team member Reverse proxy Web server or reverse proxy issues

Projects

None yet

Milestone

Autumn Release (2025.9.0)

Development

Successfully merging this pull request may close these issues.

Performance improvements to example-advanced.nginx.conf

2 participants

@nisbet-hubbard @mathilde-cryptpad
0