[英]Nginx CSP frame-src ignored
I have an Nginx CSP configured as follows: 我有一个Nginx CSP配置如下:
add_header Content-Security-Policy "default-src 'self';script-src 'self' 'unsafe-eval' https://www.google-analytics.com/analytics.js;img-src 'self' https://ssl.google-analytics.com data:;style-src 'self' 'unsafe-inline';font-src 'self' 'unsafe-inline';frame-src 'self' https:;object-src 'self';connect-src 'self' ws:;media-src 'self'
When I try to load a page in Chrome I see: 当我尝试在Chrome中加载页面时,我看到:
Refused to frame 'https://myexternalwebsite.com/a/b/index.html' because it violates the following Content Security Policy directive: "default-src 'self'". Note that 'frame-src' was not explicitly set, so 'default-src' is used as a fallback.
In my CSP frame-src is clearly set and has the values 'self' and https: 在我的CSP框架中,src显然已设置并具有值'self'和https:
What could I be doing wrong? 我能做错什么?
A bit strange but I managed to fix this by specifying: 有点奇怪,但我设法通过指定:
frame-src 'self' *;
This satisfies my requirements. 这满足了我的要求。
声明:本站的技术帖子网页,遵循CC BY-SA 4.0协议,如果您需要转载,请注明本站网址或者原文地址。任何问题请咨询:yoyou2525@163.com.