From 46693b3c2508cb547d19c18134a55b67d5141016 Mon Sep 17 00:00:00 2001
From: atlas <atlas@hyperhive.local>
Date: Wed, 28 Oct 2026 23:24:34 +0100
Subject: [PATCH] repeat the security headers in the swarm api 401 location

---
 nix/host-modules/swarm-ui.nix | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/nix/host-modules/swarm-ui.nix b/nix/host-modules/swarm-ui.nix
index ee3cf1bf..a8ccfd43 100644
--- a/nix/host-modules/swarm-ui.nix
+++ b/nix/host-modules/swarm-ui.nix
@@ -323,8 +323,12 @@ in
         # 401 with a `WWW-Authenticate` header, which the UI reads as "log in
         # again" and answers with a reload. The header is also how the UI tells
         # this 401 from one the controller sends for its own reasons.
+        # The security headers are repeated inside the `if` block that sets its
+        # own `add_header`, which would otherwise drop them.
         "@swarm_api_unauthorized".extraConfig = ''
+          ${gatewayCfg.lib.securityHeaders}
           if ($http_authorization) {
+            ${gatewayCfg.lib.securityHeaders}
             add_header WWW-Authenticate 'Bearer realm="swarm"' always;
             return 401;
           }