Anyone using nginx as a reverse proxy figured out the correct syntax to configure style-src?
I would love to see a working CSP add header for CSP
Credit goes to moderator for the pic.
AI-generated summary
Nginx as Reverse Proxy and Content Security Policy Issue
sandra.mccollum is experiencing issues with configuring Content Security Policy (CSP) when using Nginx as a reverse proxy. She shares a screenshot of the error and her Nginx config, which includes the line add_header Content Security Policy default-src 'self';.
david suggests that the issue is likely caused by the Nginx proxy config introducing the default-src 'self' header, which is not sent by Discourse. He advises sandra.mccollum to share her Nginx config, and later recommends removing the CSP header from the Nginx config or adding a condition to exclude Discourse from it.
After trying various solutions, including adding unsafe-inline to the policy, sandra.mccollum finds that commenting out the policy resolves the issue. david suggests that this allows the CSP header set by Discourse to pass through.
sandra.mccollum decides to remove the CSP from her Nginx config and allows Discourse to handle it, which results in an A+ header rating from securityheaders.com. She is pleased with the outcome but wonders why she chose to use Nginx as a reverse proxy in the first place.
Discourse does not send the default-src 'self' header in your screenshot. So, it’s very likely being introduced by your NGINX proxy config. Can you share that? (making sure to redact any sensitive content)
Yes, that is exactly what is in my add_header Content Security Policy default-src ‘self’;
I can’t actually get to it online right now.
I cant seem to find the magic to set and add style-src and get rid of the errors.
Discourse sets its own CSP header - there is no need to add your own.
So you should either remove this line from your NGINX config, or add a condition to exclude Discourse from it.
Yea, did that, same problem.
As a test I even added unsafe-inline, still same problem with login rendering and group avatars.
If I comment out the policy, it all works as expected..
That’s good. Commenting out the NGINX config means that the CSP header set by Discourse should be passed through 
I shall try that and see what securityheaders.com shows. I’ll be back…
Works great, removing CSP from nginx.conf and allowing Discourse to handle it. A+ header rating.
For the life of me, I can’t recall why I decided to go with an nginx install and reverse proxy versus just using out of the box.