From 915d62f09a8174120e8ff40c4ee2279174398f18 Mon Sep 17 00:00:00 2001
From: nobswebdev <nobswebdev@noreply.git.nobswebdev.com>
Date: Wed, 28 Oct 2026 20:56:21 +0100
Subject: [PATCH] Trust nginx proxy and drop hotlink response headers from
 Nest.

Rate limits use X-Forwarded-For behind prod nginx; hotlink security headers are set on /i/ in nginx only.
---
 backend/src/main.ts                                          | 2 ++
 .../src/modules/upload/controllers/HotlinkImageController.ts | 5 +----
 2 files changed, 3 insertions(+), 4 deletions(-)

diff --git a/backend/src/main.ts b/backend/src/main.ts
index fa90dce..b167d5d 100644
--- a/backend/src/main.ts
+++ b/backend/src/main.ts
@@ -57,6 +57,8 @@ async function bootstrap() {
         credentials: true
     });
 
+    app.set('trust proxy', 1);
+
     await app.listen(port);
 }
 
diff --git a/backend/src/modules/upload/controllers/HotlinkImageController.ts b/backend/src/modules/upload/controllers/HotlinkImageController.ts
index a54475f..f63d11a 100644
--- a/backend/src/modules/upload/controllers/HotlinkImageController.ts
+++ b/backend/src/modules/upload/controllers/HotlinkImageController.ts
@@ -1,4 +1,4 @@
-import { Controller, Get, Header, Param, StreamableFile } from '@nestjs/common';
+import { Controller, Get, Param, StreamableFile } from '@nestjs/common';
 import { HotlinkImageParamsDto } from '../dto/HotlinkImageParamsDto';
 import { UploadService } from '../services/UploadService';
 
@@ -7,9 +7,6 @@ export class HotlinkImageController {
     constructor(private readonly uploadService: UploadService) {}
 
     @Get(':id/:secret')
-    @Header('X-Content-Type-Options', 'nosniff')
-    @Header('Content-Security-Policy', 'sandbox')
-    @Header('Referrer-Policy', 'no-referrer')
     async getImage(@Param() params: HotlinkImageParamsDto): Promise<StreamableFile> {
         const { body, mimeType } = await this.uploadService.getHotlinkImage(params.id, params.secret);