Anyone using nginx as a reverse proxy figured out the correct syntax to configure style-src? I would love to see a working CSP add header for CSP [image] Credit goes to moderator for the pic.

Discourse does not send the default-src 'self' header in your screenshot. So, it’s very likely being introduced by your NGINX proxy config. Can you share that? (making sure to redact any sensitive content)

Yes, that is exactly what is in my add_header Content Security Policy default-src ‘self’; I can’t actually get to it online right now. I cant seem to find the magic to set and add style-src and get rid of the errors.

[صورة] sandra.mccollum: add_header Content Security Policy default-src ‘self’; Discourse sets its own CSP header - there is no need to add your own. So you should either remove this line from your NGINX config, or add a condition to exclude Discourse from it.

Yea, did that, same problem. As a test I even added unsafe-inline, still same problem with login rendering and group avatars. If I comment out the policy, it all works as expected..

[صورة] sandra.mccollum: If I comment out the policy, it all works as expected… That’s good. Commenting out the NGINX config means that the CSP header set by Discourse should be passed through :tada:

I shall try that and see what securityheaders.com shows. I’ll be back…

Works great, removing CSP from nginx.conf and allowing Discourse to handle it. A+ header rating. For the life of me, I can’t recall why I decided to go with an nginx install and reverse proxy versus just using out of the box.

Nginx كوكيل عكسي ومشكلة سياسة أمان المحتوى

الدعم تثبيت

david (David Taylor) 19 أغسطس 2024، 5:09م 6

هذا جيد. التعليق على تكوين NGINX يعني أنه يجب تمرير رأس CSP الذي تم تعيينه بواسطة Discourse

الموضوع		الردود	مرات العرض
Keyboard and mouse stopped working + content-security-policy error Self-hosting nginx	6	582	6 نوفمبر 2023
External nginx pagespeed module causes Security Policy violation Self-hosting	12	1983	30 يونيو 2019
Nginx config in Discourse Docker? Self-hosting	3	3412	10 فبراير 2022
After upgrade the content security policy script src for GTM Data & reporting	4	1980	13 أبريل 2021
Mitigate XSS Attacks with Content Security Policy Site Management how-to , content-security-policy	30	25692	13 يونيو 2023

Nginx كوكيل عكسي ومشكلة سياسة أمان المحتوى

الموضوعات ذات الصلة