Nginx CSP Integration

Add CSP headers to your Nginx configuration.

Prerequisites

• Nginx 1.7.5+ (for add_header support)
• Access to nginx.conf or site configuration

Quick Start

Add to your server or location block:

# Report-only mode (recommended to start)
add_header Content-Security-Policy-Report-Only "default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; report-uri https://ingest.headerhawk.com/csp/YOUR_SITE_ID" always;

Reload Nginx:

sudo nginx -t && sudo nginx -s reload

Enforcement Mode

Once you’ve tuned your policy using the reports, switch to enforcement:

add_header Content-Security-Policy "default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; report-uri https://ingest.headerhawk.com/csp/YOUR_SITE_ID" always;

Complete Example

server {
    listen 443 ssl http2;
    server_name example.com;

    # CSP Header
    add_header Content-Security-Policy-Report-Only "
        default-src 'self';
        script-src 'self' https://cdn.example.com;
        style-src 'self' 'unsafe-inline';
        img-src 'self' data: https:;
        font-src 'self';
        connect-src 'self' https://api.example.com;
        report-uri https://ingest.headerhawk.com/csp/YOUR_SITE_ID
    " always;

    # Other security headers
    add_header X-Content-Type-Options nosniff always;
    add_header X-Frame-Options DENY always;

    location / {
        # Your config...
    }
}

Configuration Tips

The always Parameter

Include always to send headers for all response codes (including errors):

add_header Content-Security-Policy "..." always;

Multiline Policies

For readability, use multiline strings:

add_header Content-Security-Policy "
    default-src 'self';
    script-src 'self';
" always;

Per-Location Policies

Different policies for different paths:

location /admin {
    add_header Content-Security-Policy "default-src 'self'; script-src 'self'" always;
}

location /public {
    add_header Content-Security-Policy "default-src 'self'; script-src 'self' 'unsafe-inline'" always;
}

Header Inheritance

add_header directives in child blocks don’t inherit from parent blocks. If you add CSP in a location block, you may need to repeat other headers.

Troubleshooting

Headers Not Appearing

1. Check Nginx config: sudo nginx -t
2. Verify the always parameter is included
3. Check if a proxy is stripping headers

Duplicate Headers

If you see duplicate CSP headers, check parent blocks. You may need to consolidate headers in one location.

Verification

Test your configuration:

curl -I https://your-site.com | grep -i content-security-policy

Next Steps

• CSP Directive Reference
• Troubleshooting Guide