title: Can't set HTTP headers for content cached by a NGINX reverse-proxy
body: <p>I have a Node.js application, running on port 8080, with a NGINX server running in front and acting as a caching reverse-proxy.</p>
  
  <p>I want NGINX to cache everythnig except one page, the dashbaord of my application: <code>/dashboard</code>.</p>
  
  <p>Here is my configuration so far:</p>
  
  <pre><code>    server {
  
      listen       80;
      server_name  mydomain.name;
  
      # SECURITY
      add_header X-Frame-Options SAMEORIGIN;
      add_header X-XSS-Protection "1; mode=block";
      add_header X-Content-Type-Options nosniff;
      add_header Content-Security-Policy "default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval'; img-src 'self' https://gravatar.com; style-src 'self' 'unsafe-inline' https://fonts.googleapis.com; font-src 'self' https://fonts.gstatic.com; object-src 'none'";
  
      ...
  
      proxy_set_header       Host $host;
      proxy_set_header   X-Forwarded-For $remote_addr;
  
      location / {
          add_header X-Proxy-Cache $upstream_cache_status;
          proxy_cache            STATIC;
          proxy_pass         http://127.0.0.1:8080;
      }
  
      location /dashboard {
          proxy_pass         http://127.0.0.1:8080/dashboard;
      }
  }
  </code></pre>
  
  <p>Caching seems to be working fine, but the security headers (<code>X-XSS-Protection</code>, <code>Content-Security-Policy</code>, etc.) seem to be only added to <code>/dashboard</code> and not to cached pages like <code>/</code> or <code>/login</code>.</p>
  
  <p>Is there somethin wrong with my current configuration? What can I do to fix the problem?</p>