nginx-http-routing.conf

server {
    listen 80;
    listen 443;
    server_name <YOUR_FRONTEND_ADDRESS_WITHOUT_HTTPS>;

    # Implement a Content Security Policy (CSP) to mitigate the risk of CSRF by restricting the sources from which scripts can be loaded.
    add_header Content-Security-Policy "default-src 'self'; script-src 'self' 'unsafe-inline'; object-src 'none'; connect-src 'self'; img-src 'self' data:; style-src 'self' 'unsafe-inline';";


    location / {
        root /usr/share/nginx/html;
        index index.html index.htm;
        try_files $uri $uri/ /index.html;
    }

    error_page 500 502 503 504 /50x.html;

    location = /50x.html {
        root /usr/share/nginx/html;
    }

    location /api/ { 
        # hooks your api calls. it means when you send calls to https://your_frontend.com/api/questions it will be transformed into http://<YOUR_BACKEND_NAME>:5212/api/questions
        # /api/ also should be presented in BACKEND Controllers routing, for example like this: [Route("api/[controller]")]
        proxy_pass http://<YOUR_BACKEND_NAME>:5212;
        proxy_http_version 1.1;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection keep-alive;
        proxy_set_header Host $host;
        proxy_cache_bypass $http_upgrade;

        # Rate limiting
        limit_req zone=mylimit burst=20 nodelay;

        # Allow only requests from your own domain
        # slightly improves the security. the next step 
        if ($http_origin !~* ^(https?://(www\.)?<YOUR_FRONTEND_DOMAIN_ADDRESS>\.com)$) {
            return 403;
        }
    }
}