Commenting out Content-Security-Policy_headers to avoid over-riding c…

[atharv2-git]

Base Branch: 9.x

Note: This PR is made to doubtfire-lms/doubtfire-web as an upstream contribution after peer review, AppAttack security verification, and mentor approval.

Description

This PR updates the internal nginx.conf in doubtfire-web to ensure that security headers (like X-Frame-Options, Content-Security-Policy, etc.) are not redundantly set or overridden when they are already enforced by the outer proxy-nginx.conf in the doubtfire-deploy repository.

This change was originally proposed and peer-reviewed in the ThothTech PR with relevant discussions and final approval from @aNebula. This upstream PR isolates the nginx.conf change only, without any unrelated deletions (e.g., package-lock.json), as per mentor's instructions.

What was changed

• Commented out internal security headers in doubtfire-web/nginx.conf that duplicate those set at the reverse proxy level.
• Ensures consistency and centralized management of security headers from the proxy-nginx.conf layer in the deployment repo.

Fixes: Header conflicts and duplication issues between inner and outer NGINX layers.

Reference PRs

• Related deployment-level changes: doubtfire-lms/doubtfire-deploy PR
• Original peer-reviewed PR: thoth-tech/doubtfire-web PR
• Background documentation: Fix ClickJacking Vulnerability Documentation

Testing Summary

• Verified that headers from proxy-nginx.conf are correctly reflected in browser responses without being overridden by internal nginx.conf.
• Confirmed that there is no duplication or conflict in the applied security headers (e.g., X-Frame-Options, Content-Security-Policy) as verified by peer reviewers and senior reviewer.
• Validated that the clickjacking vulnerability is now patched and protection mechanisms are working as expected.
• Ensured that static files are still served correctly via the inner NGINX layer.
• Addressed and resolved the package-lock.json conflict to prevent issues in cross-platform container builds, especially for Windows-based development.

Checklist

• Only the intended nginx.conf change included
• Forked cleanly from doubtfire-lms/9.x branch
• Linked deployment PR and documentation
• All peer and mentor reviews completed