default.conf

map $sent_http_content_type $addin_cache_control {
    default                  "no-cache, must-revalidate";
    ~*text/html              "no-cache, must-revalidate";
    ~*application/xml        "no-cache, must-revalidate";
    ~*application/javascript "public, max-age=300, must-revalidate";
    ~*text/css               "public, max-age=300, must-revalidate";
    ~*image/                 "public, max-age=86400";
    ~*font/                  "public, max-age=86400";
    ~*application/wasm       "public, max-age=86400";
}

# Origin allowlist for CORS. The add-in's own assets are served same-origin
# inside the Office iframe, so most requests need no CORS at all; the entries
# below cover the Microsoft origins that legitimately fetch add-in assets
# cross-origin (Office.js CDN and the Outlook hosts). The request Origin is
# echoed back only when it is on the allowlist — any other origin gets an
# empty value, and nginx then omits the Access-Control-Allow-Origin header
# entirely, so arbitrary sites cannot read responses cross-origin.
map $http_origin $addin_cors_origin {
    default                               "";
    "https://appsforoffice.microsoft.com" $http_origin;
    "https://outlook.office.com"          $http_origin;
    "https://outlook.office365.com"       $http_origin;
    "https://outlook.live.com"            $http_origin;
}

server {
    listen      80 default_server;
    server_name _;

    root  /usr/share/nginx/html;
    index taskpane.html;

    # Office hosts the add-in inside an iframe — do NOT set X-Frame-Options.
    add_header X-Content-Type-Options "nosniff" always;
    add_header Referrer-Policy        "strict-origin-when-cross-origin" always;
    add_header Cache-Control          $addin_cache_control always;

    # Restrict CORS to the allowlisted Office/Outlook origins (see the
    # $addin_cors_origin map above). For any other origin the value is empty
    # and nginx skips the header, so only the trusted Microsoft origins can
    # read add-in responses cross-origin. Vary: Origin keeps caches from
    # serving one origin's CORS response to another.
    add_header Access-Control-Allow-Origin $addin_cors_origin always;
    add_header Vary                         Origin always;

    location = /health {
        access_log off;
        add_header Content-Type text/plain;
        return 200 "ok\n";
    }

    location / {
        try_files $uri $uri/ =404;
    }

    # The manifest is served as XML; some clients are picky about the type.
    location = /manifest.xml {
        default_type application/xml;
    }

    # Hide nginx version
    server_tokens off;
}