0

I have two sites on the same Nginx server.

The site www.example.com contains HTTP headers, but not the analytics.example.com

When I go to the analytics.example.com site there is an error message in the console :

Mixed Content: The page at 'https://analytics.s1biose.com/' was loaded over HTTPS, but attempted to connect to the insecure WebSocket endpoint 'ws://analytics.example.com:7890/'. This request has been blocked; this endpoint must be available over WSS.

I think this message is displayed because of the HTTP header:

add_header Content-Security-Policy "default-src * data: 'unsafe-eval' 'unsafe-inline'" always;

from www.example.com

But why analytics.example.com inherits HTTP header from www.example.com ?

The HTTP header should be applied to www.example.com but not to analytics.example.com because the 2 sites are totally different.

How to correct this problem ?

www.example.com

server {
    listen 80 default_server;
    listen [::]:80 ipv6only=on default_server;
    server_name example.com www.example.com;

    location ^~ /.well-known/acme-challenge/ {
        default_type "text/plain";
        root /var/www/letsencrypt;
    }

    location / {
        return 301 https://www.example.com$request_uri;
    }
}

server {
    listen 443 ssl http2;
    listen [::]:443 ssl http2 ipv6only=on;
    server_name www.example.com;
    root /var/www/www-example-com/web;
    index index.php;

    ssl_certificate /etc/letsencrypt/live/www.example.com/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/www.example.com/privkey.pem;
    include /etc/letsencrypt/options-ssl-nginx.conf;
    ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem;

    add_header X-Frame-Options "SAMEORIGIN" always;
    add_header X-XSS-Protection "1; mode=block" always;
    add_header X-Content-Type-Options "nosniff" always;
    add_header Referrer-Policy "no-referrer-when-downgrade" always;
    add_header Content-Security-Policy "default-src * data: 'unsafe-eval' 'unsafe-inline'" always;
    add_header Strict-Transport-Security "max-age=31536000; includeSubDomains; preload" always;

    gzip on;
    gzip_vary on;
    gzip_proxied any;
    gzip_comp_level 6;
    gzip_types text/plain text/css text/xml application/json application/javascript application/xml+rss application/atom+xml image/svg+xml;

    brotli on;
    brotli_comp_level 6;
    brotli_types text/plain text/css text/xml application/json application/javascript application/xml+rss application/atom+xml image/svg+xml;

    expires 1209600s;

    location = /favicon.ico {
        log_not_found off;
        access_log off;
    }

    location = /robots.txt {
        allow all;
        log_not_found off;
        access_log off;
    }

    location ~* \.(txt|log)$ {
        deny all;
    }

    location ~ \..*/.*\.php$ {
        return 403;
    }

    location ~ ^/sites/.*/private/ {
        return 403;
    }

    location ~ ^/sites/[^/]+/files/.*\.php$ {
        deny all;
    }

    location ~* ^/.well-known/ {
        allow all;
    }

    location ~ (^|/)\. {
        return 403;
    }

    location / {
        try_files $uri /index.php?$query_string;
    }

    location @rewrite {
        rewrite ^/(.*)$ /index.php?q=$1;
    }

    location ~ /vendor/.*\.php$ {
        deny all;
        return 404;
    }

    location ~ '\.php$|^/update.php' {
        expires off;
        fastcgi_split_path_info ^(.+?\.php)(|/.*)$;
        include fastcgi_params;
        fastcgi_param HTTP_PROXY "";
        fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
        fastcgi_param PATH_INFO $fastcgi_path_info;
        fastcgi_param QUERY_STRING $query_string;
        fastcgi_intercept_errors on;
        fastcgi_pass unix:/var/run/php/php7.3-fpm.sock;
    }

    location ~ ^/sites/.*/files/styles/ {
        try_files $uri @rewrite;
    }

    location ~ ^(/[a-z\-]+)?/system/files/ {
        try_files $uri /index.php?$query_string;
    }

    location ~* \.(js|css|png|jpg|jpeg|gif|ico|svg)$ {
        try_files $uri @rewrite;
        expires max;
        log_not_found off;
    }
}

server {
    listen 443 ssl http2;
    listen [::]:443 ssl http2;
    server_name example.com;

    ssl_certificate /etc/letsencrypt/live/www.example.com/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/www.example.com/privkey.pem;
    include /etc/letsencrypt/options-ssl-nginx.conf;
    ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem;

    add_header X-Frame-Options "SAMEORIGIN" always;
    add_header X-XSS-Protection "1; mode=block" always;
    add_header X-Content-Type-Options "nosniff" always;
    add_header Referrer-Policy "no-referrer-when-downgrade" always;
    add_header Content-Security-Policy "default-src * data: 'unsafe-eval' 'unsafe-inline'" always;
    add_header Strict-Transport-Security "max-age=31536000; includeSubDomains; preload" always;

    location / {
        return 301 https://www.example.com$request_uri;
    }
}

analytics.example.com

server {
    listen 80;
    listen [::]:80;
    server_name analytics.example.com;

    location / {
        return 301 https://analytics.example.com$request_uri;
    }
}

server {
    listen 443 ssl http2;
    listen [::]:443 ssl http2;
    server_name analytics.example.com;
    root /var/www/analytics-example-com/web;
    index report.html;

    auth_basic "Protected";
    auth_basic_user_file /var/www/analytics-example-com/web/.htpasswd;

    ssl_certificate /etc/letsencrypt/live/analytics.example.com/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/analytics.example.com/privkey.pem;
    include /etc/letsencrypt/options-ssl-nginx.conf;
    ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem;
}

enter image description here

  • Rather than guess the cause please get your response headers (Chrome developer tools can do it) and edit your post to include them. I expect that message is because a secure page is trying to load an insecure resource, rather than a header that probably isn't there. – Tim Mar 6 at 7:00
  • I'll still venture a guess that the error has nothing to do with your CSP headers and everything to do with the lack of upgrade-insecure-requests which effectively means insecure assets (or websockets) won't be loaded if the page is served over HTTPS... – Ginnungagap Mar 6 at 7:27
0

There is no inheritance between server { } blocks.

Many browsers would block mixed content by default even when you don't have any content security policy headers sent.

It is to be expected in most cases that an http:// or ws:// resource (your exact case) would be blocked from loading on an https:// website.

nginx has nothing to do with it. Simply update any reference to their secure equivalents (wss://, https://) in your app's HTML output.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.