location /serve_uploads {
    internal;
    include /etc/nginx/zulip-include/api_headers;
    add_header Content-Security-Policy "default-src 'none'; style-src 'self' 'unsafe-inline'; img-src 'self'; object-src 'self'; plugin-types application/pdf;";
    include /etc/nginx/zulip-include/uploads.types;
    alias /home/zulip/uploads/files;
}

# This Django route not under /api is shared between mobile and web
# and thus needs API headers added, in addition to the configuration
# required to have this URL be served by Django.

location /user_uploads {
    include /etc/nginx/zulip-include/api_headers;

    include uwsgi_params;
    uwsgi_pass django;
}
