I’d be very nervous of that caching configuration. I don’t fully understand the nginx docs for proxy_ignore_headers, but by default nginx will not cache responses that include a Set-Cookie header. It looks like that config is changing that behaviour so that responses including a Set-Cookie header might be cached. If they are cached with the Set-Cookie header and then served to a different user, that might well cause someone to switch user accounts.
In theory that configuration should only apply to media files, but matching the tail end of a URL (including query parameters?) seems like a fairly unsafe way to do that.