HTML5 RDP Client Reverse Proxy

server {
    server_name rdp.meineexternedomain.net;
    listen 443 ssl; 

    ssl_certificate /etc/ssl/certs/cert.pem;
    ssl_certificate_key /etc/ssl/private/key.key;

    include snippets/authelia.conf; # Authelia auth endpoint

    location /
    {
         return 301 /RDWeb/webclient;
    }

    location /RDWeb/
    {
        proxy_pass https://rdp.intern.net/RDWeb/;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
    }
  # security headers
  add_header X-Frame-Options "SAMEORIGIN" always;  
  add_header X-XSS-Protection "1; mode=block;" always;  
  add_header X-Content-Type-Options "nosniff" always;  
  add_header Referrer-Policy "no-referrer-when-downgrade" always;  

  ### This is the header referenced above ###
  add_header Content-Security-Policy "default-src * data: 'unsafe-eval' 'unsafe-inline'; img-src * data: blob:; media-src * data: blob:" always;  

  add_header X-Robots-Tag none;
  add_header X-Download-Options noopen;
  add_header X-Permitted-Cross-Domain-Policies none;

  ### Be careful with this header; this will cause your site to break if it ever stops serving over TLS
  add_header Strict-Transport-Security "max-age=15552000; includeSubDomains";  

  # . files
  location ~ /\. {
    deny all;
  }

  # gzip
  gzip on;
  gzip_vary on;
  gzip_proxied any;
  gzip_comp_level 6;
  gzip_types text/plain text/css text/xml application/json application/javascript application/xml+rss application/atom+xml image/svg+xml;
}