Skip to content

Adding github actions for oidc-ui #2000

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
zesu22 wants to merge 4 commits into
base: develop-go
Choose a base branch
from
Open

Adding github actions for oidc-ui #2000

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
7516f34
[ADDED] github action for oidc-ui build check
zesu22 Jun 11, 2026
434f32d
[ADDED] access control allow origin for wellknown
zesu22 Jun 11, 2026
de4ee2e
[MODIFIED] helm configmap with latets nginx changes
zesu22 Jun 12, 2026
5409296
[MODIFIED] allow cors to every domain in wellknown
zesu22 Jun 12, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
57 changes: 50 additions & 7 deletions .github/workflows/push-trigger.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -10,14 +10,14 @@ on:
workflow_dispatch:
inputs:
message:
description: 'Message for manually triggering'
description: "Message for manually triggering"
required: false
default: 'Triggered for Updates'
default: "Triggered for Updates"
type: string

push:
branches:
- '!release-branch'
- "!release-branch"
- master
- develop
- develop-go
Expand All @@ -29,7 +29,7 @@ jobs:
with:
SERVICE_LOCATION: ./esignet-service
BUILD_BINARY: esignet
GO_VERSION: '1.26'
GO_VERSION: "1.26"

secrets:
SLACK_WEBHOOK_URL: ${{ secrets.SLACK_WEBHOOK }}
Expand All @@ -55,8 +55,8 @@ jobs:
strategy:
matrix:
include:
- SERVICE_LOCATION: 'esignet-service'
SERVICE_NAME: 'esignet'
- SERVICE_LOCATION: "esignet-service"
SERVICE_NAME: "esignet"
ONLY_DOCKER: true
PLATFORMS: "linux/amd64,linux/arm64"

Expand All @@ -76,4 +76,47 @@ jobs:
DEV_NAMESPACE_DOCKER_HUB: ${{ secrets.DEV_NAMESPACE_DOCKER_HUB }}
ACTOR_DOCKER_HUB: ${{ secrets.ACTOR_DOCKER_HUB }}
RELEASE_DOCKER_HUB: ${{ secrets.RELEASE_DOCKER_HUB }}
SLACK_WEBHOOK_URL: ${{ secrets.SLACK_WEBHOOK }}
SLACK_WEBHOOK_URL: ${{ secrets.SLACK_WEBHOOK }}

build-oidc-ui:
uses: mosip/kattu/.github/workflows/npm-build.yml@develop

@coderabbitai coderabbitai Bot Jun 11, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟠 Major

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
set -euo pipefail

ls -la .github/workflows || true
sed -n '60,140p' .github/workflows/push-trigger.yml

Repository: mosip/esignet

Length of output: 2772

🏁 Script executed:

#!/bin/bash
set -euo pipefail

ls -la .github/workflows || true
sed -n '60,140p' .github/workflows/push-trigger.yml

Repository: mosip/esignet

Length of output: 2772

🏁 Script executed:

#!/bin/bash
set -euo pipefail
nl -ba .github/workflows/push-trigger.yml | sed -n '70,130p'

Repository: mosip/esignet

Length of output: 100

🏁 Script executed:

#!/bin/bash
set -euo pipefail
awk 'NR>=70 && NR<=130 {print NR ":" $0}' .github/workflows/push-trigger.yml

Repository: mosip/esignet

Length of output: 2092

Pin reusable workflow references to immutable commit SHAs
.github/workflows/push-trigger.yml uses branch refs for reusable workflows that run with privileged CI:

  • Line 82: mosip/kattu/.github/workflows/npm-build.yml@develop
  • Line 95: mosip/kattu/.github/workflows/npm-sonar-analysis.yml@develop
  • Line 113: mosip/kattu/.github/workflows/docker-build.yml@master-java21

Replace each @<branch> with the exact full commit SHA of the referenced reusable workflow to prevent supply-chain drift.

Suggested fix 
-    uses: mosip/kattu/.github/workflows/npm-build.yml@develop
+    uses: mosip/kattu/.github/workflows/npm-build.yml@<commit-sha>

-    uses: mosip/kattu/.github/workflows/npm-sonar-analysis.yml@develop
+    uses: mosip/kattu/.github/workflows/npm-sonar-analysis.yml@<commit-sha>

-    uses: mosip/kattu/.github/workflows/docker-build.yml@master-java21
+    uses: mosip/kattu/.github/workflows/docker-build.yml@<commit-sha>
🧰 Tools
🪛 zizmor (1.25.2)

[error] 82-82: unpinned action reference (unpinned-uses): action is not pinned to a hash (required by blanket policy)

(unpinned-uses)

🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.github/workflows/push-trigger.yml at line 82, The workflow uses mutable
branch refs for reusable workflows; replace the three occurrences of branch refs
with their exact commit SHAs — update the strings
"mosip/kattu/.github/workflows/npm-build.yml@develop",
"mosip/kattu/.github/workflows/npm-sonar-analysis.yml@develop", and
"mosip/kattu/.github/workflows/docker-build.yml@master-java21" to use the full
commit SHA for the referenced commit in the mosip/kattu repo so the reusable
workflow calls are pinned to immutable commits.

Source: Linters/SAST tools

with:
SERVICE_LOCATION: oidc-ui
BUILD_ARTIFACT: oidc
NPM_BUILD_TYPE: BOB
NODE_VERSION: "18"
ZIP_DIR: build
secrets:
SLACK_WEBHOOK_URL: ${{ secrets.SLACK_WEBHOOK }}
Comment on lines +81 to +90

@coderabbitai coderabbitai Bot Jun 11, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟠 Major | ⚡ Quick win

Set explicit least-privilege permissions for new OIDC UI jobs.

The new jobs rely on default token permissions (static warning at Lines 81-90 and 92-102), which is broader than necessary.

Suggested fix 
 on:
   release:
     types: [published]
+permissions:
+  contents: read

If any called reusable workflow needs additional scopes, grant them only at the specific job level.

As per coding guidelines, security posture gaps that weaken guarantees should be addressed before release.

Also applies to: 92-102

🧰 Tools
🪛 zizmor (1.25.2)

[warning] 81-90: overly broad permissions (excessive-permissions): default permissions used due to no permissions: block

(excessive-permissions)

[error] 82-82: unpinned action reference (unpinned-uses): action is not pinned to a hash (required by blanket policy)

(unpinned-uses)

🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.github/workflows/push-trigger.yml around lines 81 - 90, The build-oidc-ui
job (job id build-oidc-ui that uses
mosip/kattu/.github/workflows/npm-build.yml@develop) is relying on default
GitHub Actions token permissions; add an explicit least-privilege permissions
block to the job to restrict scopes to only what the reusable workflow actually
needs (for example: contents: read, actions: write, checks: read — only include
the exact scopes required by the npm-build.yml reusable workflow and any
post-build steps like Slack notifications), and if the reusable workflow
requires extra scopes grant them at this job level only rather than leaving
defaults broad.

Source: Linters/SAST tools


sonar-analysis-oidc-ui:
needs: build-oidc-ui
if: "${{ github.event_name != 'pull_request' }}"
uses: mosip/kattu/.github/workflows/npm-sonar-analysis.yml@develop
with:
SERVICE_LOCATION: oidc-ui
NPM_BUILD_TYPE: BOB
secrets:
SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}
ORG_KEY: ${{ secrets.ORG_KEY }}
SLACK_WEBHOOK_URL: ${{ secrets.SLACK_WEBHOOK }}

build_dockers_oidc_ui:
strategy:
matrix:
include:
- SERVICE_LOCATION: "oidc-ui"
SERVICE_NAME: "oidc-ui"
SQUASH_LAYERS: "13"
fail-fast: false
name: ${{ matrix.SERVICE_NAME }}
uses: mosip/kattu/.github/workflows/docker-build.yml@master-java21
with:
SERVICE_LOCATION: ${{ matrix.SERVICE_LOCATION }}
SERVICE_NAME: ${{ matrix.SERVICE_NAME }}
SQUASH_LAYERS: ${{ matrix.SQUASH_LAYERS }}
secrets:
DEV_NAMESPACE_DOCKER_HUB: ${{ secrets.DEV_NAMESPACE_DOCKER_HUB }}
ACTOR_DOCKER_HUB: ${{ secrets.ACTOR_DOCKER_HUB }}
RELEASE_DOCKER_HUB: ${{ secrets.RELEASE_DOCKER_HUB }}
SLACK_WEBHOOK_URL: ${{ secrets.SLACK_WEBHOOK }}
26 changes: 25 additions & 1 deletion helm/oidc-ui/templates/configmap.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -21,6 +21,7 @@ data:
http {
access_log /var/log/nginx/access1.log;
error_log /var/log/nginx/error1.log;

server {
listen {{ .Values.oidc_ui.oidc_ui_port }};
server_name localhost;
Expand All @@ -35,7 +36,18 @@ data:
gzip_types text/plain text/css application/json application/javascript application/x-javascript text/xml application/xml application/xml+rss text/javascript;

location /v1/esignet {
proxy_pass http://{{ .Values.oidc_ui.oidc_service_host }}/v1/esignet;
proxy_pass http://{{ .Values.oidc_ui.oidc_service_host }}/;
proxy_redirect off;
Comment on lines +39 to +40

@coderabbitai coderabbitai Bot Jun 12, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟠 Major

Preserve the /v1/esignet path in proxy_pass (remove the trailing /;)
proxy_pass http://{{ .Values.oidc_ui.oidc_service_host }}/; inside location /v1/esignet (and location /v1/esignet/actuator/) rewrites the upstream URI by stripping the matched location prefix, which can break /v1/esignet/* forwarding—use proxy_pass http://{{ .Values.oidc_ui.oidc_service_host }}; instead. Also add Vary: Origin with your dynamic Access-Control-Allow-Origin to avoid cache-mismatched CORS responses.

🔧 Suggested fix 
         location /v1/esignet {
-          proxy_pass         http://{{ .Values.oidc_ui.oidc_service_host }}/;
+          proxy_pass         http://{{ .Values.oidc_ui.oidc_service_host }};
           proxy_redirect     off;
           proxy_set_header   Host $host;
           proxy_set_header   X-Real-IP $remote_addr;
           proxy_set_header   X-Forwarded-For $proxy_add_x_forwarded_for;
           proxy_set_header   X-Forwarded-Host $server_name;
           add_header Content-Security-Policy "default-src 'none'" always;
           add_header Referrer-Policy "no-referrer" always;
         }

         location /v1/esignet/actuator/ {
-          proxy_pass         http://{{ .Values.oidc_ui.oidc_service_host }}/;
+          proxy_pass         http://{{ .Values.oidc_ui.oidc_service_host }};
           proxy_redirect     off;
🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@helm/oidc-ui/templates/configmap.yaml` around lines 44 - 45, In the nginx
location blocks for "location /v1/esignet" and "location /v1/esignet/actuator/"
replace the proxy_pass that ends with a trailing "/;" so it does not strip the
location prefix (change the proxy_pass reference to the host value without the
trailing slash) and keep proxy_redirect off; also add an add_header Vary Origin
directive alongside your dynamic Access-Control-Allow-Origin header so caches
vary by Origin to avoid CORS mix-ups. Ensure you update the proxy_pass
occurrences that reference {{ .Values.oidc_ui.oidc_service_host }} and add the
Vary header in the same location blocks.

proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Host $server_name;
add_header Content-Security-Policy "default-src 'none'" always;
add_header Referrer-Policy "no-referrer" always;
}

location /v1/esignet/actuator/ {
proxy_pass http://{{ .Values.oidc_ui.oidc_service_host }}/;
proxy_redirect off;
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
Expand All @@ -54,6 +66,9 @@ data:
proxy_set_header X-Forwarded-Host $server_name;
add_header Content-Security-Policy "default-src 'none'" always;
add_header Referrer-Policy "no-referrer" always;
add_header 'Access-Control-Allow-Origin' '*' always;
add_header 'Access-Control-Allow-Methods' 'GET, OPTIONS' always;
add_header 'Access-Control-Allow-Headers' 'DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Authorization' always;
types {
text/plain log cer json txt;
}
Expand All @@ -68,6 +83,9 @@ data:
proxy_set_header X-Forwarded-Host $server_name;
add_header Content-Security-Policy "default-src 'none'" always;
add_header Referrer-Policy "no-referrer" always;
add_header 'Access-Control-Allow-Origin' '*' always;
add_header 'Access-Control-Allow-Methods' 'GET, OPTIONS' always;
add_header 'Access-Control-Allow-Headers' 'DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Authorization' always;
types {
text/plain log cer json txt;
}
Expand All @@ -82,6 +100,9 @@ data:
proxy_set_header X-Forwarded-Host $server_name;
add_header Content-Security-Policy "default-src 'none'" always;
add_header Referrer-Policy "no-referrer" always;
add_header 'Access-Control-Allow-Origin' '*' always;
add_header 'Access-Control-Allow-Methods' 'GET, OPTIONS' always;
add_header 'Access-Control-Allow-Headers' 'DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Authorization' always;
types {
text/plain log cer json txt;
}
Expand All @@ -96,6 +117,9 @@ data:
proxy_set_header X-Forwarded-Host $server_name;
add_header Content-Security-Policy "default-src 'none'" always;
add_header Referrer-Policy "no-referrer" always;
add_header 'Access-Control-Allow-Origin' '*' always;
add_header 'Access-Control-Allow-Methods' 'GET, OPTIONS' always;
add_header 'Access-Control-Allow-Headers' 'DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Authorization' always;
types {
text/plain log cer json txt;
}
Expand Down
73 changes: 50 additions & 23 deletions oidc-ui/nginx/nginx.conf
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,16 +1,17 @@
nginx.conf
worker_processes 1;

events {
worker_connections 1024;
}

http {
access_log /var/log/nginx/access.log;
error_log /var/log/nginx/error.log;
access_log /var/log/nginx/access1.log;
error_log /var/log/nginx/error1.log;

server {
listen 3000;
server_name localhost;
server_tokens off;

root /usr/share/nginx/html;
index index.html index.htm;
Expand All @@ -22,64 +23,90 @@ http {
gzip_types text/plain text/css application/json application/javascript application/x-javascript text/xml application/xml application/xml+rss text/javascript;

location /v1/esignet/ {
proxy_pass http://esignet.esignet/v1/esignet/;
proxy_pass http://esignet.esignet/;
proxy_redirect off;
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Host $server_name;
add_header Content-Security-Policy "default-src 'none'" always;
add_header Referrer-Policy "no-referrer" always;
proxy_connect_timeout 10s;
proxy_send_timeout 30s;
proxy_read_timeout 30s;
}
location /.well-known/openid-configuration {
proxy_pass http://esignet.esignet/v1/esignet/oidc/.well-known/openid-configuration;

location /v1/esignet/actuator/ {
proxy_pass http://esignet.esignet/;
proxy_redirect off;
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Host $server_name;
add_header Content-Security-Policy "default-src 'none'" always;
add_header Referrer-Policy "no-referrer" always;
proxy_connect_timeout 10s;
proxy_send_timeout 30s;
proxy_read_timeout 30s;
}

location /.well-known/jwks.json {
proxy_pass http://esignet.esignet/v1/esignet/oauth/.well-known/jwks.json;
proxy_pass http://esignet.esignet/.well-known/jwks.json;
proxy_redirect off;
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Host $server_name;
add_header Content-Security-Policy "default-src 'none'" always;
add_header Referrer-Policy "no-referrer" always;
proxy_connect_timeout 10s;
proxy_send_timeout 30s;
proxy_read_timeout 30s;
add_header 'Access-Control-Allow-Origin' '*' always;
add_header 'Access-Control-Allow-Methods' 'GET, OPTIONS' always;
add_header 'Access-Control-Allow-Headers' 'DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Authorization' always;
types {
text/plain log cer json txt;
}
}
Comment on lines 47 to +62

@coderabbitai coderabbitai Bot Jun 11, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟠 Major | ⚡ Quick win

Multiple issues with well-known endpoint configuration.

  1. Path mismatch: Proxying to /.well-known/jwks.json differs from Helm config which uses /v1/esignet/oauth/.well-known/jwks.json. Verify the upstream service exposes this endpoint at the root path.

  2. Missing OPTIONS preflight handling: CORS headers are added but preflight OPTIONS requests will be proxied to upstream instead of being handled by nginx. Add explicit OPTIONS handling:

  3. Incorrect MIME type: The types block sets .json to text/plain. JWKS and OIDC discovery documents should return application/json per RFC 7517 and RFC 8414.

Proposed fix for OPTIONS handling and MIME type 
     location /.well-known/jwks.json {
+      if ($request_method = 'OPTIONS') {
+        add_header 'Access-Control-Allow-Origin' $cors_allowed_origin;
+        add_header 'Access-Control-Allow-Methods' 'GET, OPTIONS';
+        add_header 'Access-Control-Allow-Headers' 'DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Authorization';
+        add_header 'Access-Control-Max-Age' 1728000;
+        add_header 'Content-Type' 'text/plain; charset=utf-8';
+        add_header 'Content-Length' 0;
+        return 204;
+      }
       proxy_pass         http://esignet.esignet/.well-known/jwks.json;
       ...
       types {
-        text/plain log cer json txt;
+        application/json json;
+        text/plain log cer txt;
       }
     }
📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change
location /.well-known/jwks.json {
proxy_pass http://esignet.esignet/v1/esignet/oauth/.well-known/jwks.json;
proxy_pass http://esignet.esignet/.well-known/jwks.json;
proxy_redirect off;
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Host $server_name;
add_header Content-Security-Policy "default-src 'none'" always;
add_header Referrer-Policy "no-referrer" always;
proxy_connect_timeout 10s;
proxy_send_timeout 30s;
proxy_read_timeout 30s;
add_header 'Access-Control-Allow-Origin' $cors_allowed_origin always;
add_header 'Access-Control-Allow-Methods' 'GET, OPTIONS' always;
add_header 'Access-Control-Allow-Headers' 'DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Authorization' always;
types {
text/plain log cer json txt;
}
}
location /.well-known/jwks.json {
if ($request_method = 'OPTIONS') {
add_header 'Access-Control-Allow-Origin' $cors_allowed_origin;
add_header 'Access-Control-Allow-Methods' 'GET, OPTIONS';
add_header 'Access-Control-Allow-Headers' 'DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Authorization';
add_header 'Access-Control-Max-Age' 1728000;
add_header 'Content-Type' 'text/plain; charset=utf-8';
add_header 'Content-Length' 0;
return 204;
}
proxy_pass http://esignet.esignet/.well-known/jwks.json;
proxy_redirect off;
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Host $server_name;
add_header Content-Security-Policy "default-src 'none'" always;
add_header Referrer-Policy "no-referrer" always;
add_header 'Access-Control-Allow-Origin' $cors_allowed_origin always;
add_header 'Access-Control-Allow-Methods' 'GET, OPTIONS' always;
add_header 'Access-Control-Allow-Headers' 'DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Authorization' always;
types {
application/json json;
text/plain log cer txt;
}
}
🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@oidc-ui/nginx/nginx.conf` around lines 52 - 67, The location block for
/.well-known/jwks.json is wrong and incomplete: confirm and update proxy_pass to
the correct upstream path used in Helm (e.g.,
/v1/esignet/oauth/.well-known/jwks.json) or adjust the location to match the
upstream; add an explicit OPTIONS handler inside the same location (or a
separate location = /.well-known/jwks.json if needed) that returns 204 with the
same CORS headers instead of proxying preflight to upstream (update the existing
add_header lines: Access-Control-Allow-Origin, -Allow-Methods, -Allow-Headers to
be included in the OPTIONS response), and change the types mapping so .json and
the JWKS response use application/json (remove or replace the current mapping
that sets json to text/plain) to comply with RFC 7517/8414; refer to the
location block, proxy_pass directive, add_header lines, and the types block when
making these edits.


location /.well-known/openid-configuration {
proxy_pass http://esignet.esignet/.well-known/openid-configuration;
proxy_redirect off;
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Host $server_name;
add_header Content-Security-Policy "default-src 'none'" always;
add_header Referrer-Policy "no-referrer" always;
add_header 'Access-Control-Allow-Origin' '*' always;
add_header 'Access-Control-Allow-Methods' 'GET, OPTIONS' always;
add_header 'Access-Control-Allow-Headers' 'DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Authorization' always;
types {
text/plain log cer json txt;
}
}

location /.well-known/oauth-authorization-server {
proxy_pass http://esignet.esignet/v1/esignet/oauth/.well-known/oauth-authorization-server;
proxy_pass http://esignet.esignet/.well-known/oauth-authorization-server;
proxy_redirect off;
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Host $server_name;
add_header Content-Security-Policy "default-src 'none'" always;
add_header Referrer-Policy "no-referrer" always;
proxy_connect_timeout 10s;
proxy_send_timeout 30s;
proxy_read_timeout 30s;
add_header 'Access-Control-Allow-Origin' '*' always;
add_header 'Access-Control-Allow-Methods' 'GET, OPTIONS' always;
add_header 'Access-Control-Allow-Headers' 'DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Authorization' always;
types {
text/plain log cer json txt;
}
}

location / {
# alias /usr/share/nginx/html;
try_files $uri $uri/ /index.html;
add_header Content-Security-Policy "
default-src 'self';
style-src 'self' https://fonts.googleapis.com 'unsafe-inline';
font-src 'self' https://fonts.gstatic.com;
img-src 'self' data: https://cdn.jsdelivr.net https://*.mosip.net;
script-src 'self' https://www.google.com https://www.gstatic.com;
frame-src https://www.google.com;
connect-src 'self' http://127.0.0.1:*;
" always;
add_header Referrer-Policy "no-referrer" always;
}
}
}
}
Loading