Remove wildcard sources from script-src on nginx

Why it matters

A script-src that allows *, http:, https: or data: lets an attacker load a script from any server they control, so the policy does not stop script injection. List the exact hosts you use, or switch to nonces with 'strict-dynamic'.

Staged change. Do this in stages and check each one before the next, so a mistake does not break your site or your mail.

The fix

1. Stage 1: add a report-only copy of the policy with explicit hosts next to the current add_header line, run sudo nginx -t and reload.
2. Stage 2: replace the wildcard in the enforced Content-Security-Policy and remove the report-only line.

add_header Content-Security-Policy-Report-Only "script-src 'self' https://scripts.vendor.example; object-src 'none'; base-uri 'self'" always;

Read the documentation ↗(opens in a new tab)

Related

• Reported by the Content-Security-Policy check
• Add a Content-Security-Policy
• Enforce the report-only Content-Security-Policy
• Send the Content-Security-Policy as an HTTP header
• Restrict where scripts can load from
• Replace 'unsafe-inline' scripts with nonces or hashes
• Remove 'unsafe-eval' from script-src
• Set object-src to 'none'
• Add base-uri to the Content-Security-Policy
• Reduce reliance on inline styles
• Fix the Content-Security-Policy syntax