By platform
Content Security Policy by platform
The policy is the same everywhere. Where it goes, and what stops it arriving, differs: an nginx location block that drops it, an Apache redirect that never had it, a Next.js page rendered before any nonce existed.
Each page below is a complete, report-only config for one platform, with the problems particular to it. A Content Security Policy is the broadest of the controls browsers enforce on the code your pages load, and what client-side security is covers the rest.
What every config assumes
- Report-only. Every config sets
Content-Security-Policy-Report-Only, which blocks nothing. Read what it reports, then switch to enforcing. - A starting policy, not yours. The directives allow your own origin and little else, so a real site reports on its first page load.
- A placeholder endpoint. The reports go to
your-ingest-codeon HeaderHawk's ingest URL. Any collector that accepts CSP reports works instead. - A stated check. Under each config is what was done to it: the server and version it ran on, or, where a platform cannot run locally, what it was validated against.
CSP on nginx
A report-only CSP for nginx, why an add_header in a location block drops the policy the server block set, and why the header value must stay on one line.
CSP on Apache
A report-only CSP for Apache httpd, why Header set misses redirects and error pages, and when Header always set sends a second policy instead of replacing the first.
CSP in Next.js
A nonce-based report-only CSP in a Next.js proxy, why statically rendered pages never get the nonce, and why 'unsafe-eval' belongs in development only.
CSP in Node.js
A report-only CSP with Express and Helmet, why helmet() enforces a policy you never wrote, and why middleware order decides which responses carry yours.
CSP with Docker
A report-only CSP at the reverse proxy in front of a container, what happens when the app and the proxy both send one, and where Kubernetes ingress snippets went.
CSP on Cloudflare
A report-only CSP from a Cloudflare Worker, Transform Rules versus Workers, and the scripts Cloudflare's own features add to pages your policy has to account for.
CSP on Vercel
A report-only CSP in vercel.json, why the Vercel Toolbar fills preview deployments with reports, and how to write header rules that never depend on their order.
CSP on Netlify
A report-only CSP in a Netlify _headers file, why it never reaches function-rendered or proxied responses, and why two rules should never set the same header.