0

I have two different servers, one using nginx 1.18 and another using 1.22.

The headers on the 1.18 version are:

        add_header Content-Security-Policy "default-src 'self' 'unsafe-inline';
                                           script-src 'strict-dynamic';
                                           script-src-elem 'self' maps.googleapis.com;
                                           img-src 'self' maps.gstatic.com *.googleapis.com data:;
                                           connect-src 'self' *.googleapis.com ingka-icow-test.eu.auth0.com/oauth/token wss: mqtt.tornadostorage.com/mqtt data: blob:;
                                           base-uri 'self';
                                           object-src 'none';
                                           font-src fonts.gstatic.com;
                                           style-src 'self' 'unsafe-inline' fonts.googleapis.com;";

However, this doesn't work on version 1.22 and I get this error on Chrome:

The Content-Security-Policy directive name ':' contains one or more invalid characters. Only ASCII alphanumeric characters or dashes '-' are allowed in directive names.

In order to make it work, all the policies have to be on the same line. Is this related to the nginx version or could be something else?

1 Answer 1

2

What works for me is to break the lines with a backslash

 add_header Content-Security-Policy "default-src 'self' 'unsafe-inline'; \
                                           script-src 'strict-dynamic'; \
                                           script-src-elem 'self' maps.googleapis.com; \
                                           img-src 'self' maps.gstatic.com *.googleapis.com data:; \
                                           connect-src 'self' *.googleapis.com ingka-icow-test.eu.auth0.com/oauth/token wss: mqtt.tornadostorage.com/mqtt data: blob:; \
                                           base-uri 'self'; \
                                           object-src 'none'; \
                                           font-src fonts.gstatic.com; \
                                           style-src 'self' 'unsafe-inline' fonts.googleapis.com;";

The syntax is quite specific.

httpd configuration files contain one directive per line. The backslash "" may be used as the last character on a line to indicate that the directive continues onto the next line. There must be no other characters or white space between the backslash and the end of the line.

Arguments to directives are separated by whitespace. If an argument contains spaces, you must enclose that argument in quotes.

Apache > HTTP Server > Documentation > Version 2.4

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.