Implementing Strict Content Security Policy (CSP) & Security Headers

Content Security Policy (CSP) is one of the most effective defense-in-depth mechanisms against Cross-Site Scripting (XSS), data injection, and clickjacking attacks. Configuring strict security response headers ensures web applications defend against modern client-side attack vectors.

1. Recommended Nginx Security Headers Configuration

Add the following directives to your Nginx site configuration block:

# Strict-Transport-Security (HSTS)
add_header Strict-Transport-Security "max-age=31536000; includeSubDomains; preload" always;

# Prevent Clickjacking
add_header X-Frame-Options "DENY" always;

# Block MIME-type sniffing
add_header X-Content-Type-Options "nosniff" always;

# Referrer Policy Control
add_header Referrer-Policy "strict-origin-when-cross-origin" always;

# Permissions Policy (Disable unnecessary browser APIs)
add_header Permissions-Policy "geolocation=(), microphone=(), camera=()" always;

# Strict Content Security Policy (CSP)
add_header Content-Security-Policy "default-src 'self'; script-src 'self' https://cdn.jsdelivr.net; style-src 'self' 'unsafe-inline' https://cdn.jsdelivr.net https://fonts.googleapis.com; font-src 'self' https://fonts.gstatic.com; img-src 'self' data:; connect-src 'self';" always;

2. Key Header Definitions

• X-Content-Type-Options: nosniff: Instructs the browser to strictly follow the declared Content-Type header rather than attempting to guess the file format.
• Strict-Transport-Security (HSTS): Forces browsers to interact with your site exclusively over encrypted HTTPS connections.
• X-Frame-Options: DENY: Prevents your web pages from being embedded within <iframe> elements on third-party domains.

3. Testing Your Configuration

Verify your security header deployment using curl from the command line:

curl -I https://zyekh.com