Initial commit - realms platform

openresty/nginx.conf

@@ -4,6 +4,12 @@ error_log stderr warn;
 # Run worker processes as nobody user (master process remains root for port binding)
 user nobody nogroup;
 
+# Expose environment variables to Lua workers
+env REDIS_PASS;
+env REDIS_PORT;
+env REDIS_HOST;
+env JWT_SECRET;
+
 events {
     worker_connections 1024;
 }
@@ -25,51 +31,87 @@ http {
     lua_package_path "/usr/local/openresty/nginx/lua/?.lua;;";
     lua_shared_dict stream_keys 10m;
     lua_shared_dict rate_limit 10m;
+    lua_shared_dict fingerprints 10m;  # Server-side fingerprint cache
+    lua_shared_dict uberban_cache 1m;  # Uberban status cache (5 second TTL)
     
     # Enable compression
     gzip on;
     gzip_vary on;
     gzip_min_length 1024;
-    gzip_types text/plain text/css text/xml text/javascript application/javascript application/json application/xml+rss image/svg+xml;
+    gzip_types text/plain text/css text/xml text/javascript application/javascript application/json application/xml+rss;
     
     # Security headers
     add_header X-Frame-Options "SAMEORIGIN" always;
     add_header X-Content-Type-Options "nosniff" always;
     add_header X-XSS-Protection "1; mode=block" always;
     add_header Referrer-Policy "strict-origin-when-cross-origin" always;
+    # SECURITY FIX #17: Content Security Policy (application-wide)
+    # Note: 'unsafe-inline' required for style-src because Svelte uses inline styles for transitions and dynamic bindings
+    add_header Content-Security-Policy "default-src 'self'; script-src 'self' https://www.youtube.com https://s.ytimg.com; style-src 'self' 'unsafe-inline' https://cdnjs.cloudflare.com; img-src 'self' data: https: blob:; media-src 'self' blob: https:; frame-src https://www.youtube.com https://www.youtube-nocookie.com; connect-src 'self' wss: ws:; font-src 'self' data: https://cdnjs.cloudflare.com;" always;
     
     # Map to handle CORS origin properly
     map $http_origin $cors_origin {
-        default "";
-        "~^https?://localhost(:[0-9]+)?$" $http_origin;
-        "~^https?://127\.0\.0\.1(:[0-9]+)?$" $http_origin;
-        "~^https?://\[::1\](:[0-9]+)?$" $http_origin;
+        default $http_origin;
+        "" "";
     }
-    
+
+    # Map for WebSocket upgrade
+    map $http_upgrade $connection_upgrade {
+        default upgrade;
+        '' close;
+    }
+
     upstream backend {
         server drogon-backend:8080;
     }
-    
+
+    upstream chat {
+        server chat-service:8081;
+    }
+
     upstream frontend {
         server sveltekit:3000;
     }
-    
+
     upstream ome {
         server ovenmediaengine:8080;
     }
-    
+
     # Rate limiting zones
     limit_req_zone $binary_remote_addr zone=api_limit:10m rate=10r/s;
     limit_req_zone $binary_remote_addr zone=auth_limit:10m rate=3r/m;
     limit_req_zone $binary_remote_addr zone=register_limit:10m rate=1r/m;
+    limit_req_zone $binary_remote_addr zone=chat_limit:10m rate=20r/s;
+    limit_req_zone $binary_remote_addr zone=avatar_limit:10m rate=5r/s;
+    limit_req_zone $binary_remote_addr zone=nakama_limit:10m rate=30r/s;
+    # SECURITY FIX #11: Rate limit viewer token requests
+    limit_req_zone $binary_remote_addr zone=viewer_token_limit:10m rate=10r/m;
     
-    # Increase client max body size for avatar uploads
-    client_max_body_size 1m;
+    # Increase client max body size for file uploads
+    # Default for most uploads (images, stickers)
+    client_max_body_size 5m;
     
     server {
         listen 80;
         server_name localhost;
-        
+
+        # ACME challenge endpoint for Let's Encrypt certificate validation
+        # This must come before any access control blocks
+        location /.well-known/acme-challenge/ {
+            root /var/www/certbot;
+            try_files $uri =404;
+        }
+
+        # Site-wide uberban check - blocks banned fingerprints from all endpoints
+        access_by_lua_block {
+            -- Skip OPTIONS requests (CORS preflight)
+            if ngx.req.get_method() == "OPTIONS" then
+                return
+            end
+            local uberban = require "uberban"
+            uberban.check_and_block()
+        }
+
         # Security headers for the whole server
         add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;
         
@@ -77,19 +119,62 @@ http {
         location /uploads/ {
             # Use root directive with absolute path to avoid alias+try_files bug
             root /app;
-            
+
             # Security settings
             autoindex off;
-            add_header X-Content-Type-Options "nosniff" always;
-            
+
             # Only serve files, not directories
             try_files $uri =404;
-            
+
+            # Explicit MIME types for uploaded files
+            # SVG is safe when loaded via <img> tags (browsers sandbox them)
+            types {
+                image/jpeg jpg jpeg;
+                image/png png;
+                image/gif gif;
+                image/webp webp;
+                image/svg+xml svg svgz;
+                audio/mpeg mp3;
+                audio/wav wav;
+                audio/ogg ogg;
+                audio/mp4 m4a;
+                video/mp4 mp4 m4v;
+                video/webm webm;
+                video/quicktime mov;
+            }
+            default_type application/octet-stream;
+
+            # Security headers for all uploaded content
+            add_header X-Content-Type-Options "nosniff" always;
+            add_header Content-Security-Policy "default-src 'none'" always;
+            add_header X-Frame-Options "DENY" always;
+
             # Cache static images
             location ~* \.(jpg|jpeg|png|gif|webp|svg)$ {
                 expires 30d;
                 add_header Cache-Control "public, immutable" always;
                 add_header X-Content-Type-Options "nosniff" always;
+                add_header Content-Security-Policy "default-src 'none'" always;
+                add_header X-Frame-Options "DENY" always;
+            }
+
+            # Cache audio files
+            location ~* \.(mp3|wav|ogg|m4a)$ {
+                expires 7d;
+                add_header Cache-Control "public, max-age=604800" always;
+                add_header X-Content-Type-Options "nosniff" always;
+                add_header Content-Security-Policy "default-src 'none'" always;
+                add_header X-Frame-Options "DENY" always;
+            }
+
+            # Cache video files
+            location ~* \.(mp4|m4v|webm|mov)$ {
+                expires 7d;
+                add_header Cache-Control "public, max-age=604800" always;
+                add_header X-Content-Type-Options "nosniff" always;
+                add_header Content-Security-Policy "default-src 'none'" always;
+                add_header X-Frame-Options "DENY" always;
+                add_header Accept-Ranges bytes;
             }
         }
         
@@ -238,27 +323,55 @@ http {
             add_header Cache-Control "public, max-age=300" always;
         }
         
-        # Public realm endpoints (with viewer token authentication for stream-key)
-        location ~ ^/api/realms/(by-name/[^/]+|live|[0-9]+/stats|[0-9]+/viewer-token|[0-9]+/stream-key)$ {
+        # SECURITY FIX #11: Rate-limited viewer token endpoint
+        location ~ ^/api/realms/[0-9]+/viewer-token$ {
+            limit_req zone=viewer_token_limit burst=5 nodelay;
+
             # CORS headers
             add_header Access-Control-Allow-Origin $cors_origin always;
             add_header Access-Control-Allow-Methods "GET, OPTIONS" always;
             add_header Access-Control-Allow-Headers "Content-Type" always;
             add_header Access-Control-Allow-Credentials "true" always;
-            
+
             if ($request_method = 'OPTIONS') {
                 add_header Content-Length 0;
                 add_header Content-Type text/plain;
                 return 204;
             }
-            
+
             proxy_pass http://backend;
             proxy_set_header Host $host;
             proxy_set_header X-Real-IP $remote_addr;
             proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
             proxy_set_header X-Forwarded-Proto $scheme;
             proxy_set_header Cookie $http_cookie;
-            
+
+            # No cache for tokens
+            expires -1;
+            add_header Cache-Control "no-store, no-cache" always;
+        }
+
+        # Public realm endpoints (with viewer token authentication for stream-key)
+        location ~ ^/api/realms/(by-name/[^/]+|live|[0-9]+/stats|[0-9]+/stream-key)$ {
+            # CORS headers
+            add_header Access-Control-Allow-Origin $cors_origin always;
+            add_header Access-Control-Allow-Methods "GET, OPTIONS" always;
+            add_header Access-Control-Allow-Headers "Content-Type" always;
+            add_header Access-Control-Allow-Credentials "true" always;
+
+            if ($request_method = 'OPTIONS') {
+                add_header Content-Length 0;
+                add_header Content-Type text/plain;
+                return 204;
+            }
+
+            proxy_pass http://backend;
+            proxy_set_header Host $host;
+            proxy_set_header X-Real-IP $remote_addr;
+            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+            proxy_set_header X-Forwarded-Proto $scheme;
+            proxy_set_header Cookie $http_cookie;
+
             # Short cache for live realm data
             expires 10s;
             add_header Cache-Control "public, max-age=10" always;
@@ -286,52 +399,387 @@ http {
             proxy_set_header Cookie $http_cookie;
         }
         
-        # Other API endpoints (authenticated)
-        location /api/ {
-            limit_req zone=api_limit burst=20 nodelay;
-            
+        # Chat service API endpoints
+        location /api/chat/ {
+            limit_req zone=chat_limit burst=30 nodelay;
+
             # CORS headers
             add_header Access-Control-Allow-Origin $cors_origin always;
             add_header Access-Control-Allow-Methods "GET, POST, PUT, DELETE, OPTIONS" always;
             add_header Access-Control-Allow-Headers "Content-Type, Authorization" always;
             add_header Access-Control-Allow-Credentials "true" always;
-            
+
             # Handle preflight
             if ($request_method = 'OPTIONS') {
                 add_header Content-Length 0;
                 add_header Content-Type text/plain;
                 return 204;
             }
-            
+
+            proxy_pass http://chat;
+            proxy_set_header Host $host;
+            proxy_set_header X-Real-IP $remote_addr;
+            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+            proxy_set_header X-Forwarded-Proto $scheme;
+            proxy_set_header Cookie $http_cookie;
+
+            # Don't cache API responses
+            expires -1;
+            add_header Cache-Control "no-store, no-cache, must-revalidate" always;
+        }
+
+        # Chat WebSocket endpoints
+        location /chat/ws {
+            # Inject server-side fingerprint header (cannot be spoofed by client)
+            access_by_lua_block {
+                local fingerprint = require "fingerprint"
+                fingerprint.inject_header()
+            }
+
+            proxy_pass http://chat;
+            proxy_http_version 1.1;
+            proxy_buffering off;
+            proxy_set_header Upgrade $http_upgrade;
+            proxy_set_header Connection $connection_upgrade;
+            proxy_set_header Host $host;
+            proxy_set_header X-Real-IP $remote_addr;
+            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+            proxy_set_header X-Forwarded-Proto $scheme;
+
+            # WebSocket timeouts
+            proxy_read_timeout 3600s;
+            proxy_send_timeout 3600s;
+        }
+
+        location ~ ^/chat/stream/(.+)$ {
+            # Inject server-side fingerprint header (cannot be spoofed by client)
+            access_by_lua_block {
+                local fingerprint = require "fingerprint"
+                fingerprint.inject_header()
+            }
+
+            proxy_pass http://chat;
+            proxy_http_version 1.1;
+            proxy_buffering off;
+            proxy_set_header Upgrade $http_upgrade;
+            proxy_set_header Connection $connection_upgrade;
+            proxy_set_header Host $host;
+            proxy_set_header X-Real-IP $remote_addr;
+            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+            proxy_set_header X-Forwarded-Proto $scheme;
+
+            # WebSocket timeouts
+            proxy_read_timeout 3600s;
+            proxy_send_timeout 3600s;
+        }
+
+        # Watch room sync WebSocket endpoint
+        location /watch/ws {
+            # Inject server-side fingerprint header (cannot be spoofed by client)
+            access_by_lua_block {
+                local fingerprint = require "fingerprint"
+                fingerprint.inject_header()
+            }
+
+            proxy_pass http://chat;
+            proxy_http_version 1.1;
+            proxy_buffering off;
+            proxy_set_header Upgrade $http_upgrade;
+            proxy_set_header Connection $connection_upgrade;
+            proxy_set_header Host $host;
+            proxy_set_header X-Real-IP $remote_addr;
+            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+            proxy_set_header X-Forwarded-Proto $scheme;
+
+            # WebSocket timeouts
+            proxy_read_timeout 3600s;
+            proxy_send_timeout 3600s;
+        }
+
+        # Ebook upload endpoint - larger body size limit
+        location = /api/user/ebooks {
+            # CORS headers
+            add_header Access-Control-Allow-Origin $cors_origin always;
+            add_header Access-Control-Allow-Methods "GET, POST, OPTIONS" always;
+            add_header Access-Control-Allow-Headers "Content-Type, Authorization" always;
+            add_header Access-Control-Allow-Credentials "true" always;
+
+            # Handle preflight
+            if ($request_method = 'OPTIONS') {
+                add_header Content-Length 0;
+                add_header Content-Type text/plain;
+                return 204;
+            }
+
+            # JWT validation at edge
+            access_by_lua_block {
+                local jwt_validator = require "jwt"
+                jwt_validator.validate_and_inject()
+            }
+
+            # Allow 100MB for ebook uploads
+            client_max_body_size 100m;
+
             proxy_pass http://backend;
             proxy_set_header Host $host;
             proxy_set_header X-Real-IP $remote_addr;
             proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
             proxy_set_header X-Forwarded-Proto $scheme;
             proxy_set_header Cookie $http_cookie;
-            
+
+            # Extended timeout for large uploads
+            proxy_read_timeout 300s;
+            proxy_send_timeout 300s;
+
             # Don't cache API responses
             expires -1;
             add_header Cache-Control "no-store, no-cache, must-revalidate" always;
         }
-        
+
+        # Audio upload endpoint - larger body size limit
+        location = /api/user/audio {
+            # CORS headers
+            add_header Access-Control-Allow-Origin $cors_origin always;
+            add_header Access-Control-Allow-Methods "GET, POST, OPTIONS" always;
+            add_header Access-Control-Allow-Headers "Content-Type, Authorization" always;
+            add_header Access-Control-Allow-Credentials "true" always;
+
+            # Handle preflight
+            if ($request_method = 'OPTIONS') {
+                add_header Content-Length 0;
+                add_header Content-Type text/plain;
+                return 204;
+            }
+
+            # JWT validation at edge
+            access_by_lua_block {
+                local jwt_validator = require "jwt"
+                jwt_validator.validate_and_inject()
+            }
+
+            # Allow 500MB for audio uploads
+            client_max_body_size 500m;
+
+            proxy_pass http://backend;
+            proxy_set_header Host $host;
+            proxy_set_header X-Real-IP $remote_addr;
+            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+            proxy_set_header X-Forwarded-Proto $scheme;
+            proxy_set_header Cookie $http_cookie;
+
+            # Extended timeout for large uploads
+            proxy_read_timeout 600s;
+            proxy_send_timeout 600s;
+
+            # Don't cache API responses
+            expires -1;
+            add_header Cache-Control "no-store, no-cache, must-revalidate" always;
+        }
+
+        # Video upload endpoint - larger body size limit
+        location = /api/user/videos {
+            # CORS headers
+            add_header Access-Control-Allow-Origin $cors_origin always;
+            add_header Access-Control-Allow-Methods "GET, POST, OPTIONS" always;
+            add_header Access-Control-Allow-Headers "Content-Type, Authorization" always;
+            add_header Access-Control-Allow-Credentials "true" always;
+
+            # Handle preflight
+            if ($request_method = 'OPTIONS') {
+                add_header Content-Length 0;
+                add_header Content-Type text/plain;
+                return 204;
+            }
+
+            # JWT validation at edge
+            access_by_lua_block {
+                local jwt_validator = require "jwt"
+                jwt_validator.validate_and_inject()
+            }
+
+            # Allow 500MB for video uploads
+            client_max_body_size 500m;
+
+            proxy_pass http://backend;
+            proxy_set_header Host $host;
+            proxy_set_header X-Real-IP $remote_addr;
+            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+            proxy_set_header X-Forwarded-Proto $scheme;
+            proxy_set_header Cookie $http_cookie;
+
+            # Extended timeout for large uploads
+            proxy_read_timeout 600s;
+            proxy_send_timeout 600s;
+
+            # Don't cache API responses
+            expires -1;
+            add_header Cache-Control "no-store, no-cache, must-revalidate" always;
+        }
+
+        # Default avatar random endpoint - rate limited to prevent abuse
+        location = /api/default-avatar/random {
+            limit_req zone=avatar_limit burst=10 nodelay;
+
+            # CORS headers
+            add_header Access-Control-Allow-Origin $cors_origin always;
+            add_header Access-Control-Allow-Methods "GET, OPTIONS" always;
+            add_header Access-Control-Allow-Headers "Content-Type" always;
+            add_header Access-Control-Allow-Credentials "true" always;
+
+            # Handle preflight
+            if ($request_method = 'OPTIONS') {
+                add_header Content-Length 0;
+                add_header Content-Type text/plain;
+                return 204;
+            }
+
+            proxy_pass http://backend;
+            proxy_set_header Host $host;
+            proxy_set_header X-Real-IP $remote_addr;
+            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+            proxy_set_header X-Forwarded-Proto $scheme;
+
+            # Don't cache - ensures random avatar each time
+            expires -1;
+            add_header Cache-Control "no-store, no-cache, must-revalidate" always;
+        }
+
+        # Block internal API endpoints from external access (used for service-to-service communication)
+        location /api/internal/ {
+            return 403;
+        }
+
+        # Other API endpoints (authenticated)
+        location /api/ {
+            limit_req zone=api_limit burst=20 nodelay;
+
+            # CORS headers
+            add_header Access-Control-Allow-Origin $cors_origin always;
+            add_header Access-Control-Allow-Methods "GET, POST, PUT, DELETE, OPTIONS" always;
+            add_header Access-Control-Allow-Headers "Content-Type, Authorization" always;
+            add_header Access-Control-Allow-Credentials "true" always;
+
+            # Handle preflight
+            if ($request_method = 'OPTIONS') {
+                add_header Content-Length 0;
+                add_header Content-Type text/plain;
+                return 204;
+            }
+
+            # JWT validation at edge - reject invalid tokens before hitting backend
+            access_by_lua_block {
+                local jwt_validator = require "jwt"
+                jwt_validator.validate_and_inject()
+            }
+
+            proxy_pass http://backend;
+            proxy_set_header Host $host;
+            proxy_set_header X-Real-IP $remote_addr;
+            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+            proxy_set_header X-Forwarded-Proto $scheme;
+            proxy_set_header Cookie $http_cookie;
+
+            # Don't cache API responses
+            expires -1;
+            add_header Cache-Control "no-store, no-cache, must-revalidate" always;
+        }
+
         # WebSocket
         location /ws/ {
             proxy_pass http://backend;
             proxy_http_version 1.1;
             proxy_set_header Upgrade $http_upgrade;
-            proxy_set_header Connection "upgrade";
+            proxy_set_header Connection $connection_upgrade;
             proxy_set_header Host $host;
             proxy_set_header X-Real-IP $remote_addr;
             proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
             proxy_set_header X-Forwarded-Proto $scheme;
             proxy_set_header Cookie $http_cookie;
-            
+
             # WebSocket timeouts
             proxy_read_timeout 3600s;
             proxy_send_timeout 3600s;
         }
-        
+
+        # Stream thumbnails - 3 second animated WebP generated on-demand via FFmpeg
+        location ~ ^/thumb/([^/]+)\.webp$ {
+            set $stream_key $1;
+
+            # CORS headers for preflight
+            if ($request_method = 'OPTIONS') {
+                add_header Access-Control-Allow-Origin $cors_origin always;
+                add_header Access-Control-Allow-Methods "GET, OPTIONS" always;
+                add_header Access-Control-Allow-Credentials "true" always;
+                add_header Content-Length 0;
+                add_header Content-Type text/plain;
+                return 204;
+            }
+
+            # Generate and serve thumbnail via Lua
+            content_by_lua_block {
+                local thumbnail = require "thumbnail"
+                thumbnail.serve()
+            }
+        }
+
+        # Nakama Game Server HTTP API (/v2/ is the default path used by nakama-js)
+        # Uses runtime DNS resolution via variable to avoid startup failures
+        location /v2/ {
+            limit_req zone=nakama_limit burst=50 nodelay;
+
+            # CORS headers
+            add_header Access-Control-Allow-Origin $cors_origin always;
+            add_header Access-Control-Allow-Methods "GET, POST, PUT, DELETE, OPTIONS" always;
+            add_header Access-Control-Allow-Headers "Content-Type, Authorization" always;
+            add_header Access-Control-Allow-Credentials "true" always;
+
+            if ($request_method = 'OPTIONS') {
+                add_header Access-Control-Allow-Origin $cors_origin always;
+                add_header Access-Control-Allow-Methods "GET, POST, PUT, DELETE, OPTIONS" always;
+                add_header Access-Control-Allow-Headers "Content-Type, Authorization" always;
+                add_header Access-Control-Allow-Credentials "true" always;
+                add_header Content-Length 0;
+                add_header Content-Type text/plain;
+                return 204;
+            }
+
+            # Runtime DNS resolution - nakama may not be ready at nginx startup
+            set $nakama_backend nakama:7350;
+            proxy_pass http://$nakama_backend;
+            proxy_set_header Host $host;
+            proxy_set_header X-Real-IP $remote_addr;
+            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+            proxy_set_header X-Forwarded-Proto $scheme;
+
+            # Hide Nakama's CORS headers - nginx handles CORS
+            proxy_hide_header Access-Control-Allow-Origin;
+            proxy_hide_header Access-Control-Allow-Methods;
+            proxy_hide_header Access-Control-Allow-Headers;
+            proxy_hide_header Access-Control-Allow-Credentials;
+
+            expires -1;
+            add_header Cache-Control "no-store, no-cache" always;
+        }
+
+        # Nakama Game Server WebSocket (nakama-js connects to /ws with query params)
+        location = /ws {
+            # Runtime DNS resolution
+            set $nakama_backend nakama:7350;
+            # Must include $is_args$args when using variables - nginx won't auto-append query string
+            proxy_pass http://$nakama_backend/ws$is_args$args;
+            proxy_http_version 1.1;
+            proxy_buffering off;
+            proxy_set_header Upgrade $http_upgrade;
+            proxy_set_header Connection $connection_upgrade;
+            proxy_set_header Host $host;
+            proxy_set_header X-Real-IP $remote_addr;
+            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+            proxy_set_header X-Forwarded-Proto $scheme;
+
+            proxy_read_timeout 3600s;
+            proxy_send_timeout 3600s;
+        }
+
         # Frontend (all other requests)
         location / {
             proxy_pass http://frontend;
@@ -339,7 +787,7 @@ http {
             proxy_set_header X-Real-IP $remote_addr;
             proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
             proxy_set_header X-Forwarded-Proto $scheme;
-            
+
             # Enable HTTP/1.1 for keep-alive
             proxy_http_version 1.1;
             proxy_set_header Connection "";
@@ -350,7 +798,17 @@ http {
     server {
         listen 8088;
         server_name localhost;
-        
+
+        # Site-wide uberban check - blocks banned fingerprints from streaming
+        access_by_lua_block {
+            -- Skip OPTIONS requests (CORS preflight)
+            if ngx.req.get_method() == "OPTIONS" then
+                return
+            end
+            local uberban = require "uberban"
+            uberban.check_and_block()
+        }
+
         # Security headers
         add_header X-Content-Type-Options "nosniff" always;
         
@@ -365,44 +823,49 @@ http {
             add_header Access-Control-Allow-Headers "Range" always;
             add_header Access-Control-Allow-Credentials "true" always;
             add_header Access-Control-Expose-Headers "Content-Length,Content-Range" always;
-            
+
             # Handle preflight
             if ($request_method = 'OPTIONS') {
+                add_header Access-Control-Allow-Origin $cors_origin always;
+                add_header Access-Control-Allow-Methods "GET, OPTIONS" always;
+                add_header Access-Control-Allow-Headers "Range" always;
+                add_header Access-Control-Allow-Credentials "true" always;
                 add_header Content-Length 0;
                 add_header Content-Type text/plain;
                 return 204;
             }
-            
+
             # Access control via Lua
+            # SECURITY FIX #24: Removed token value logging - sensitive data should not be in logs
             access_by_lua_block {
                 local redis_helper = require "redis_helper"
-                
-                -- Get viewer token from cookie
-                local cookie_header = ngx.var.http_cookie
-                if not cookie_header then
-                    ngx.status = ngx.HTTP_FORBIDDEN
-                    ngx.say("No authentication token")
-                    return ngx.exit(ngx.HTTP_FORBIDDEN)
-                end
-                
-                -- Extract viewer_token cookie
-                local token = nil
-                -- Handle URL-encoded cookies and spaces
-                cookie_header = ngx.unescape_uri(cookie_header)
-                for k, v in string.gmatch(cookie_header, "([^=]+)=([^;]+)") do
-                    k = k:match("^%s*(.-)%s*$") -- trim whitespace
-                    if k == "viewer_token" then
-                        token = v:match("^%s*(.-)%s*$") -- trim whitespace
-                        break
+
+                -- Get viewer token from query parameter or cookie
+                local token = ngx.var.arg_token
+
+                -- If not in query parameter, try cookie
+                if not token then
+                    local cookie_header = ngx.var.http_cookie
+                    if cookie_header then
+                        -- Extract viewer_token cookie
+                        -- Handle URL-encoded cookies and spaces
+                        cookie_header = ngx.unescape_uri(cookie_header)
+                        for k, v in string.gmatch(cookie_header, "([^=]+)=([^;]+)") do
+                            k = k:match("^%s*(.-)%s*$") -- trim whitespace
+                            if k == "viewer_token" then
+                                token = v:match("^%s*(.-)%s*$") -- trim whitespace
+                                break
+                            end
+                        end
                     end
                 end
-                
+
                 if not token then
                     ngx.status = ngx.HTTP_FORBIDDEN
                     ngx.say("Missing viewer token")
                     return ngx.exit(ngx.HTTP_FORBIDDEN)
                 end
-                
+
                 -- Validate token
                 local valid_stream = redis_helper.validate_viewer_token(token, ngx.var.stream_key)
                 if not valid_stream then
@@ -410,25 +873,26 @@ http {
                     ngx.say("Invalid viewer token")
                     return ngx.exit(ngx.HTTP_FORBIDDEN)
                 end
-                
-                -- Optionally refresh token TTL on segment access
+
+                -- Refresh token TTL on segment access
                 redis_helper.refresh_viewer_token(token)
             }
             
-            # Cache settings for segments
-            location ~ \.ts$ {
-                expires 1h;
-                add_header Cache-Control "public, max-age=3600" always;
+            # Cache settings based on file type
+            # Segments (.ts, .m4s) - cache for 1 hour, playlists (.m3u8) - no cache
+            set $cache_control "no-cache, no-store, must-revalidate";
+            set $expires_time "-1";
+            if ($file_path ~ \.(ts|m4s)$) {
+                set $cache_control "public, max-age=3600";
+                set $expires_time "1h";
             }
-            
-            # Don't cache playlists
-            location ~ \.m3u8$ {
-                expires -1;
-                add_header Cache-Control "no-cache, no-store, must-revalidate" always;
-            }
-            
-            # Proxy to OvenMediaEngine
-            proxy_pass http://ome/app/$stream_key/$file_path;
+
+            expires $expires_time;
+            add_header Cache-Control $cache_control always;
+            add_header X-Content-Type-Options "nosniff" always;
+
+            # Proxy to OvenMediaEngine (preserve query string for session parameter)
+            proxy_pass http://ome/app/$stream_key/$file_path$is_args$args;
             proxy_set_header Host $host;
             proxy_set_header X-Real-IP $remote_addr;
             proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;