# Nginx as reverse proxy and Content Security Policy issue
**URL:** https://meta.discourse.org/t/nginx-as-reverse-proxy-and-content-security-policy-issue/322288
**Category:** Self-hosting
**Tags:** nginx
**Created:** [August 19, 2024, 3:55pm UTC](https://meta.discourse.org/t/nginx-as-reverse-proxy-and-content-security-policy-issue/322288 "2024-08-19T15:55:18Z")
**Posts on this page:** 9
**Page:** 1
### Author:  [@sandra.mccollum](https://meta.discourse.org/u/sandra.mccollum)
#### Post date: [August 19, 2024, 3:55pm UTC](https://meta.discourse.org/t/nginx-as-reverse-proxy-and-content-security-policy-issue/322288/1 "2024-08-19T15:55:18Z")
Anyone using nginx as a reverse proxy figured out the correct syntax to configure style-src?
I would love to see a working CSP add header for CSP
Credit goes to moderator for the pic.
---
### Author:  [@david](https://meta.discourse.org/u/david)
#### Post date: [August 19, 2024, 4:07pm UTC](https://meta.discourse.org/t/nginx-as-reverse-proxy-and-content-security-policy-issue/322288/2 "2024-08-19T16:07:34Z")
Discourse does not send the `default-src 'self'` header in your screenshot. So, it’s very likely being introduced by your NGINX proxy config. Can you share that? (making sure to redact any sensitive content)
---
### Author:  [@sandra.mccollum](https://meta.discourse.org/u/sandra.mccollum)
#### Post date: [August 19, 2024, 4:26pm UTC](https://meta.discourse.org/t/nginx-as-reverse-proxy-and-content-security-policy-issue/322288/3 "2024-08-19T16:26:19Z")
Yes, that is exactly what is in my add\_header Content Security Policy default-src ‘self’;
I can’t actually get to it online right now.
I cant seem to find the magic to set and add style-src and get rid of the errors.
---
### Author:  [@david](https://meta.discourse.org/u/david)
#### Post date: [August 19, 2024, 4:50pm UTC](https://meta.discourse.org/t/nginx-as-reverse-proxy-and-content-security-policy-issue/322288/4 "2024-08-19T16:50:58Z")
> [@sandra.mccollum](#):
>
> add\_header Content Security Policy default-src ‘self’;
Discourse sets its own CSP header - there is no need to add your own.
So you should either remove this line from your NGINX config, or add a condition to exclude Discourse from it.
---
### Author:  [@sandra.mccollum](https://meta.discourse.org/u/sandra.mccollum)
#### Post date: [August 19, 2024, 5:04pm UTC](https://meta.discourse.org/t/nginx-as-reverse-proxy-and-content-security-policy-issue/322288/5 "2024-08-19T17:04:19Z")
Yea, did that, same problem.
As a test I even added unsafe-inline, still same problem with login rendering and group avatars.
If I comment out the policy, it all works as expected..
---
### Author:  [@david](https://meta.discourse.org/u/david)
#### Post date: [August 19, 2024, 5:09pm UTC](https://meta.discourse.org/t/nginx-as-reverse-proxy-and-content-security-policy-issue/322288/6 "2024-08-19T17:09:02Z")
> [@sandra.mccollum](#):
>
> If I comment out the policy, it all works as expected…
That’s good. Commenting out the NGINX config means that the CSP header set by Discourse should be passed through 🎉
---
### Author:  [@sandra.mccollum](https://meta.discourse.org/u/sandra.mccollum)
#### Post date: [August 19, 2024, 8:35pm UTC](https://meta.discourse.org/t/nginx-as-reverse-proxy-and-content-security-policy-issue/322288/7 "2024-08-19T20:35:34Z")
I shall try that and see what [securityheaders.com](http://securityheaders.com) shows. I’ll be back…
---
### Author:  [@sandra.mccollum](https://meta.discourse.org/u/sandra.mccollum)
#### Post date: [August 19, 2024, 11:49pm UTC](https://meta.discourse.org/t/nginx-as-reverse-proxy-and-content-security-policy-issue/322288/8 "2024-08-19T23:49:49Z")
Works great, removing CSP from nginx.conf and allowing Discourse to handle it. A+ header rating.
For the life of me, I can’t recall why I decided to go with an nginx install and reverse proxy versus just using out of the box.
---
### Author:  [@david](https://meta.discourse.org/u/david)
#### Post date: [August 21, 2024, 7:00am UTC](https://meta.discourse.org/t/nginx-as-reverse-proxy-and-content-security-policy-issue/322288/9 "2024-08-21T07:00:19Z")
This topic was automatically closed after 22 hours. New replies are no longer allowed.