From 0de55a388fea8414a83a80288501659f035bde6b Mon Sep 17 00:00:00 2001
From: Jonas Elfering <j.elfering@shopware.com>
Date: Thu, 15 Oct 2026 10:27:24 +0200
Subject: [PATCH] docs(hosting): align static asset CSP on 6.5

---
 .../config-reference/server/apache.md         | 22 +++++++++++++++++++
 .../config-reference/server/nginx.md          | 21 +++++++++++++++---
 2 files changed, 40 insertions(+), 3 deletions(-)

diff --git a/resources/references/config-reference/server/apache.md b/resources/references/config-reference/server/apache.md
index b40222374d..836718c457 100644
--- a/resources/references/config-reference/server/apache.md
+++ b/resources/references/config-reference/server/apache.md
@@ -20,3 +20,25 @@ The document root must always point to the public folder, to ensure all function
    CustomLog ${APACHE_LOG_DIR}/shopware.access.log combined
 </VirtualHost>
 ```
+
+Enable `mod_rewrite` and `mod_headers`, and deploy the current `public/.htaccess` from the Shopware template.
+The following additions restrict existing HTML files under `media/` and `thumbnail/`, and apply the same policy to SVG files.
+Place the rewrite condition and rule before the existing rule that serves files directly; keep the header directives in the `mod_headers` block.
+
+```apache
+<IfModule mod_rewrite.c>
+    RewriteEngine On
+    RewriteCond %{REQUEST_FILENAME} -f
+    RewriteRule ^(?:media|thumbnail)/.*\.(?i:html)$ - [E=SHOPWARE_STATIC_HTML:1]
+</IfModule>
+
+<IfModule mod_headers.c>
+    Header set Content-Security-Policy "script-src 'none'; object-src 'none'; frame-src 'none'; base-uri 'none'; form-action 'none'" env=SHOPWARE_STATIC_HTML
+    <FilesMatch "\.(?i:svg)$">
+        Header set Content-Security-Policy "script-src 'none'; object-src 'none'; frame-src 'none'; base-uri 'none'; form-action 'none'"
+    </FilesMatch>
+</IfModule>
+```
+
+These rules leave application-rendered HTML and bundled HTML applications unchanged.
+Custom static documents must work without scripts, embedded documents, base URL overrides or form submissions; images and styles remain permitted.
diff --git a/resources/references/config-reference/server/nginx.md b/resources/references/config-reference/server/nginx.md
index 707ce841af..2d287f1324 100644
--- a/resources/references/config-reference/server/nginx.md
+++ b/resources/references/config-reference/server/nginx.md
@@ -4,6 +4,10 @@
 The document root must always point to the public folder, to ensure all functionality works.
 :::
 
+The static-file policy below restricts SVG files and HTML files under `media/` and `thumbnail/`.
+Missing HTML media files return 404; application-rendered HTML and bundled HTML applications retain their own response policies.
+Custom static documents must work without scripts, embedded documents, base URL overrides or form submissions; images and styles remain permitted.
+
 ```text
 server {
     listen 80;
@@ -37,6 +41,14 @@ server {
         }
     }
     
+    # Stored HTML must not affect pages rendered by PHP.
+    location ~* ^/(media|thumbnail)/.*[.]html$ {
+        try_files $uri =404;
+        expires 1y;
+        add_header Cache-Control "public, must-revalidate, proxy-revalidate";
+        add_header Content-Security-Policy "script-src 'none'; object-src 'none'; frame-src 'none'; base-uri 'none'; form-action 'none'";
+    }
+
     location ~ ^/(theme|media|thumbnail|bundles|css|fonts|js|recovery|sitemap)/ {
         expires 1y;
         add_header Cache-Control "public, must-revalidate, proxy-revalidate";
@@ -48,13 +60,13 @@ server {
         open_file_cache_errors off;
     
         location ~* ^.+\.svg {
-            add_header Content-Security-Policy "script-src 'none'";
+            add_header Content-Security-Policy "script-src 'none'; object-src 'none'; frame-src 'none'; base-uri 'none'; form-action 'none'";
             add_header Cache-Control "public, must-revalidate, proxy-revalidate";
             log_not_found off;
         }
     }
 
-    location ~* ^.+\.(?:css|cur|js|jpe?g|gif|ico|png|svg|webp|html|woff|woff2|xml)$ {
+    location ~* ^.+\.(?:css|cur|js|jpe?g|gif|ico|png|webp|html|woff|woff2|xml)$ {
         expires 1y;
         add_header Cache-Control "public, must-revalidate, proxy-revalidate";
 
@@ -75,7 +87,10 @@ server {
     }
 
     location ~* ^.+\.svg$ {
-        add_header Content-Security-Policy "script-src 'none'";
+        try_files $uri /index.php$is_args$args;
+        expires 1y;
+        add_header Cache-Control "public, must-revalidate, proxy-revalidate";
+        add_header Content-Security-Policy "script-src 'none'; object-src 'none'; frame-src 'none'; base-uri 'none'; form-action 'none'";
     }
 
     location / {