NGINX
Implement Content Security Policy (CSP) for Enhanced Protection
Secure your web application against XSS and data injection by implementing a robust Content Security Policy (CSP), restricting allowed content sources and behaviors.
add_header Content-Security-Policy "default-src 'self';
script-src 'self' https://trusted-cdn.com;
style-src 'self' 'unsafe-inline';
img-src 'self' data: https://cdn.example.com;
font-src 'self' https://fonts.gstatic.com;
connect-src 'self' https://api.example.com;
frame-ancestors 'self';
form-action 'self';
object-src 'none';
base-uri 'self';" always;
How it works: Content Security Policy (CSP) is an HTTP security header that helps prevent various types of attacks, including Cross-Site Scripting (XSS) and data injection. It specifies which content sources are allowed to be loaded and executed by the browser. This Nginx configuration sets a strict CSP, allowing resources only from the 'self' origin (your domain) and explicitly trusted third-party domains, blocking untrusted scripts, styles, and other content.