Security headers that vanish on one path
nginx’s add_header is inherited only when a block has none of its own. Compare response headers for two paths with curl -I and find the location that drops HSTS and CSP.
Briefing
The security headers grader gives portal.corp.example an A on the home page and an F on /account/. The config sets the headers once at server level.
nginx rule: a location that has any add_header directive does not inherit add_header lines from the server block. It is a common surprise.
edge-02 · Web config review
Type help for the command list and objectives for your tasks. Everything runs in this browser.
Up and down arrows walk your history. Ctrl+L clears the screen. Try help, ls, and objectives.