Answer the question
In order to leave comments, you need to log in
How to initialize variable when adding Content Security Policy to Nginx configs?
Good afternoon!
After adding the Content Security Policy rules to the Nginx config, errors began to appear in the log file:
2018/12/09 22:55:05 [warn] 500#500: *18 using uninitialized "csp" variable while reading response header from upstream, client: xxx.xx.xx.xxx, server: site.ru, request: "GET /page/2/ HTTP/2.0", upstream: "fastcgi://unix:/var/www/php-fpm/xxxxxxxx.sock:", host: "site.ru", referrer: "https://site.ru/"
2018/12/09 22:55:15 [warn] 500#500: *60 using uninitialized "csp" variable while reading response header from upstream, client: xxx.xx.xx.xxx, server: site.ru, request: "GET /page/2/ HTTP/2.0", upstream: "fastcgi://unix:/var/www/php-fpm/xxxxxxxx.sock:", host: "site.ru", referrer: "https://site.ru/"
set $CSP_image "img-src 'self' 'unsafe-inline' 'unsafe-eval' data: *.printfriendly.com *.w.org *.gravatar.com *.vimeocdn.com; ";
set $CSP_script "script-src 'self' 'unsafe-inline' 'unsafe-eval' *.w.org *.gravatar.com *.googleapis.com *.jsdelivr.net *.printfriendly.com *.kxcdn.com *.vimeocdn.com *.hs-analytics.net *.securitymetrics.com *.google-analytics.com; ";
set $CSP_style "style-src 'self' 'unsafe-inline' *.googleapis.com *.bootstrapcdn.com *.gstatic.com *.vimeocdn.com; ";
set $CSP_font "font-src 'self' data: *.googleapis.com *.bootstrapcdn.com *.gstatic.com *.googleapis.com; ";
set $CSP_frame "frame-src 'self' *.vimeocdn.com *.vimeo.com; ";
set $CSP_object "object-src 'self' ; ";
set $CSP "default-src 'self' ; ${CSP_image} ${CSP_script} ${CSP_style} ${CSP_font} ${CSP_frame} ${CSP_object}";
add_header Content-Security-Policy $CSP;
Answer the question
In order to leave comments, you need to log in
Didn't find what you were looking for?
Ask your questionAsk a Question
731 491 924 answers to any question