5.3.3 Ensure that Content Security Policy (CSP) is enabled and configured properly

Information

Content Security Policy allows administrators to specify the locations from which allowable scripts may be executed, or if scripts may be executed at all. Content Security Policy should be used to improve user trust of your website.

Rationale:

Content Security Policies assist organizations in mitigating and reporting cross-site scripting (XSS) attacks.

Solution

Open your nginx configuration file that contains your server blocks. Add the below line into your server block to add Content-Security-Policy and direct your user agent to accept documents from only specific origins.

add_header Content-Security-Policy 'default-src 'self'' always;

Default Value:

This is not enabled by default.

See Also

https://workbench.cisecurity.org/files/4212