title: nginx reverse proxy content-security-policy not working
body: <p>ive installed Firefly via dockerhub on my cloud vm, all is working fine. Iam now trying to access it via https (lets encrypt is setup correctly, I can reach the base domain via https just fine.)</p>
  
  <p>Firefly runs as a docker under port :90. Its accessible and fully functional.
  But whenever I try to access it via https, certain CSP headers (e.g base-uri and form-action) are not set.</p>
  
  <p>Current nginx.conf excerpts (http:// is infront of the domain, but sof doesnt let me include it):</p>
  
  <pre><code>location /firefly/ { proxy_pass mydomain.org:90[1]/; }
  </code></pre>
  
  <p>ive tried to include in the above</p>
  
  <pre><code>add_header Content-Security-Policy "form-action 'self'; base-uri 'self' ";
  </code></pre>
  
  <p>or</p>
  
  <pre><code>proxy_set_header Content-Security-Policy "form-action 'self'; base-uri 'self' ";
  </code></pre>
  
  <p>I have also tried the same commands with a '*' instead of 'self'.</p>
  
  <p>I keep getting mydomain.org:90 resource was blocked form-action and base-uri.</p>
  
  <p>Error:
  <a href="https://i.stack.imgur.com/eKS1y.png" rel="nofollow noreferrer">browser errors</a>
  Send Headers:
  <a href="https://i.stack.imgur.com/1FR0X.png" rel="nofollow noreferrer">double csp?</a></p>
  
  <p>Does anyone know, what I am doing wrong?
  Any help is greatly appreciated.</p>