github-starred/actual
2
0
Fork 0
mirror of https://github.com/actualbudget/actual.git synced 2026-11-12 03:42:19 -06:00
Code Issues 3.0k Packages Projects Releases 58 Wiki Activity

[PR #6477] [MERGED] docs: add guidance on avoiding Nginx header collisions for COOP/COEP #32479

New Issue
Closed
opened 2026-04-18 08:30:33 -05:00 by GiteaMirror · 0 comments
GiteaMirror commented 2026-04-18 08:30:33 -05:00
Owner
Copy Link
Copy Source

📋 Pull Request Information

Original PR: https://github.com/actualbudget/actual/pull/6477
Author: @lagathub
Created: 12/23/2025
Status: ✅ Merged
Merged: 1/5/2026
Merged by: @MikesGlitch

Base: master ← Head: patch-1

📝 Commits (7)

  • e157786 fix-nginx-header-collision
  • d2498bd Fix formatting of headers in NGINX documentation
  • 32737c6 Add new terms to spelling expectations
  • 6d020a2 Fix placement of 'COOP' in expect.txt
  • ac0c2ba Merge branch 'master' into patch-1
  • d063158 Update reverse-proxies.md doc display
  • b2b159e Merge branch 'master' into patch-1

📊 Changes

2 files changed (+27 additions, -0 deletions)

View changed files

📝 .github/actions/docs-spelling/expect.txt (+2 -0)
📝 packages/docs/docs/config/reverse-proxies.md (+25 -0)

📄 Description

The current Nginx documentation notes that "additional security mechanisms" should be implemented but doesn't specify the pitfalls of manual header management.

In modern deployments, actual-server sends its own COOP/COEP headers. When a user adds these manually in Nginx (as often required for SSL/Secure Contexts), it results in duplicated headers which browsers reject, causing a fatal app crash.

This PR adds a recommendation to use proxy_hide_header to ensure Nginx serves as the single source of truth for security policies, preventing the SharedArrayBufferMissing error.

Summary by CodeRabbit

  • Documentation
    • Added guidance on NGINX cross-origin isolation, risks from duplicated COOP/COEP headers and potential SharedArrayBufferMissing.
    • Documented using NGINX as the authoritative source for security headers, how to prevent header duplication (e.g., hiding proxied headers) and included a complete example location block.
    • Added COEP and COOP to the documentation spelling/expect list.

✏️ Tip: You can customize this high-level summary in your review settings.

🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.

## 📋 Pull Request Information **Original PR:** https://github.com/actualbudget/actual/pull/6477 **Author:** [@lagathub](https://github.com/lagathub) **Created:** 12/23/2025 **Status:** ✅ Merged **Merged:** 1/5/2026 **Merged by:** [@MikesGlitch](https://github.com/MikesGlitch) **Base:** `master` ← **Head:** `patch-1` --- ### 📝 Commits (7) - [`e157786`](https://github.com/actualbudget/actual/commit/e157786234aa395cc6243d2262e6e5718b64a85d) fix-nginx-header-collision - [`d2498bd`](https://github.com/actualbudget/actual/commit/d2498bd3a4511bbeb841742e00f351de85be5232) Fix formatting of headers in NGINX documentation - [`32737c6`](https://github.com/actualbudget/actual/commit/32737c64ea9614ec021371c63a0e4480df5dcf2f) Add new terms to spelling expectations - [`6d020a2`](https://github.com/actualbudget/actual/commit/6d020a25b56be57206a9f9720063d50db53a575e) Fix placement of 'COOP' in expect.txt - [`ac0c2ba`](https://github.com/actualbudget/actual/commit/ac0c2baded0e1b7a4046e5afe6adc136aa1e7ca4) Merge branch 'master' into patch-1 - [`d063158`](https://github.com/actualbudget/actual/commit/d06315812275a5d0c045426edee7e09ac24d8cd5) Update reverse-proxies.md doc display - [`b2b159e`](https://github.com/actualbudget/actual/commit/b2b159eabc935f535a1dd3128948502568af1c96) Merge branch 'master' into patch-1 ### 📊 Changes **2 files changed** (+27 additions, -0 deletions) <details> <summary>View changed files</summary> 📝 `.github/actions/docs-spelling/expect.txt` (+2 -0) 📝 `packages/docs/docs/config/reverse-proxies.md` (+25 -0) </details> ### 📄 Description The current Nginx documentation notes that "additional security mechanisms" should be implemented but doesn't specify the pitfalls of manual header management. In modern deployments, actual-server sends its own COOP/COEP headers. When a user adds these manually in Nginx (as often required for SSL/Secure Contexts), it results in duplicated headers which browsers reject, causing a fatal app crash. This PR adds a recommendation to use proxy_hide_header to ensure Nginx serves as the single source of truth for security policies, preventing the SharedArrayBufferMissing error. <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Documentation** * Added guidance on NGINX cross-origin isolation, risks from duplicated COOP/COEP headers and potential SharedArrayBufferMissing. * Documented using NGINX as the authoritative source for security headers, how to prevent header duplication (e.g., hiding proxied headers) and included a complete example location block. * Added COEP and COOP to the documentation spelling/expect list. <sub>✏️ Tip: You can customize this high-level summary in your review settings.</sub> <!-- end of auto-generated comment: release notes by coderabbit.ai --> --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>
GiteaMirror added the pull-request label 2026-04-18 08:30:33 -05:00
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
AI generated
API
bank sync
budgeting
bug
can’t replicate
dependencies
docker
documentation
electron
experimental feature
feature
feedback
goal templates
good first issue
help wanted
importers
maintenance
needs info
needs testing
needs triage
needs votes
openid
payees
pull-request
Mirrored from GitHub Pull Request
 regression
reports
responsive
rules
schedules
server
✨ merged
split transactions
tech debt
tech-support
theme
transaction import
transaction reconciliation
transactions
translations
upstream
user interface
✅ approved
wontfix
No labels pull-request
Milestone
No items
No Milestone
Projects
Clear projects
No projects
Assignees
Clear assignees
GiteaMirror ninjasurge (Kaehlen Rog)
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: github-starred/actual#32479