I have a server running nginx and I would like to add CSP. However I'm encountering difficulties even after following numerous guides I will either get an error from nginx or they just don't work. Here is what the header looks like at the moment:

add_header Content-Security-Policy "default-src 'self'; \
script-src 'self' google-analytics.com; \
img-src 'self' google-analytics.com;

Using this entry however causes nginx to report that there's an error in the config file. I want to restrict access to both myself and Google Analytics as it's the only thing I'm not serving from nginx.

Nginx Configuration file

  • And what was the error that it reported? – Michael Hampton Aug 28 '13 at 5:44
  • @MichaelHampton "Restarting nginx: nginx: [emerg] unexpected "c" in /etc/nginx/sites-enabled/www:80 nginx: configuration file /etc/nginx/nginx.conf test failed" – Concrete Donkey Aug 28 '13 at 6:06
  • You should look at that line, then. – Michael Hampton Aug 28 '13 at 6:07
  • I have and normally the only way I can find to correct it to try a completely different configuration which once again gets an error or just doesn't work. – Concrete Donkey Aug 28 '13 at 6:15
  • I have no idea what's on line 80 of that file, since you didn't post it for us to look at. There's no way anyone can help you under those circumstances. – Michael Hampton Aug 28 '13 at 6:15

You forgot the closing quotation mark (") and semicolon (;) on line 40.

Nginx shows the error on line 80 because it is the next occurrence of a quote in the file.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.