github-starred/actual
2
0
Fork 0
mirror of https://github.com/actualbudget/actual.git synced 2026-03-10 04:02:38 -05:00
Code Issues 250 Packages Projects Releases 53 Wiki Activity

[PR #6477] docs: add guidance on avoiding Nginx header collisions for COOP/COEP #6554

New Issue
Closed
opened 2026-02-28 21:29:57 -06:00 by GiteaMirror · 0 comments
GiteaMirror commented 2026-02-28 21:29:57 -06:00
Owner
Copy Link

Original Pull Request: https://github.com/actualbudget/actual/pull/6477

State: closed
Merged: Yes

The current Nginx documentation notes that "additional security mechanisms" should be implemented but doesn't specify the pitfalls of manual header management.

In modern deployments, actual-server sends its own COOP/COEP headers. When a user adds these manually in Nginx (as often required for SSL/Secure Contexts), it results in duplicated headers which browsers reject, causing a fatal app crash.

This PR adds a recommendation to use proxy_hide_header to ensure Nginx serves as the single source of truth for security policies, preventing the SharedArrayBufferMissing error.

Summary by CodeRabbit

  • Documentation
    • Added guidance on NGINX cross-origin isolation, risks from duplicated COOP/COEP headers and potential SharedArrayBufferMissing.
    • Documented using NGINX as the authoritative source for security headers, how to prevent header duplication (e.g., hiding proxied headers) and included a complete example location block.
    • Added COEP and COOP to the documentation spelling/expect list.

✏️ Tip: You can customize this high-level summary in your review settings.

**Original Pull Request:** https://github.com/actualbudget/actual/pull/6477 **State:** closed **Merged:** Yes --- The current Nginx documentation notes that "additional security mechanisms" should be implemented but doesn't specify the pitfalls of manual header management. In modern deployments, actual-server sends its own COOP/COEP headers. When a user adds these manually in Nginx (as often required for SSL/Secure Contexts), it results in duplicated headers which browsers reject, causing a fatal app crash. This PR adds a recommendation to use proxy_hide_header to ensure Nginx serves as the single source of truth for security policies, preventing the SharedArrayBufferMissing error. <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Documentation** * Added guidance on NGINX cross-origin isolation, risks from duplicated COOP/COEP headers and potential SharedArrayBufferMissing. * Documented using NGINX as the authoritative source for security headers, how to prevent header duplication (e.g., hiding proxied headers) and included a complete example location block. * Added COEP and COOP to the documentation spelling/expect list. <sub>✏️ Tip: You can customize this high-level summary in your review settings.</sub> <!-- end of auto-generated comment: release notes by coderabbit.ai -->
GiteaMirror added the pull-request label 2026-02-28 21:29:57 -06:00
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
AI generated
API
bank sync
budgeting
bug
can’t replicate
dependencies
docker
documentation
electron
experimental feature
feature
feedback
goal templates
good first issue
help wanted
importers
maintenance
needs info
needs testing
needs triage
needs votes
openid
payees
pull-request
Mirrored from GitHub Pull Request
 regression
reports
responsive
rules
schedules
server
✨ merged
split transactions
tech debt
theme
transaction import
transaction reconciliation
transactions
translations
upstream
user interface
✅ approved
wontfix
No Label pull-request
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
GiteaMirror ninjasurge
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: github-starred/actual#6554
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?