Nginx的跨域Content Security Policy通行设置 2025-03-20 网站 暂无评论 115 次阅读 HTTPS 是 HTTP over Secure Socket Layer，以安全为目标的 HTTP 通道，所以在 HTTPS 承载的页面上不允许出现 http 请求，一旦出现就是提示或报错： ``` Mixed Content: The page at ‘https://www.taobao.com/‘ was loaded over HTTPS, but requested an insecure image ‘http://g.alicdn.com/s.gif’. This content should also be served over HTTPS. ``` HTTPS改造之后，我们可以在很多页面中看到如下警报：  upgrade-insecure-requests CSP 指令的作用就是让浏览器自动升级请求，防止访问者访问不安全的内容。 该指令用于让浏览器自动升级请求从http到https,用于大量包含http资源的http网页直接升级到https而不会报错.简洁的来讲,就相当于在http和https之间起的一个过渡作用. #html强制让http的访问Https ``` <meta http-equiv="Content-Security-Policy" content="upgrade-insecure-requests"/> ``` #php强制让http的访问Https ``` header("Content-Security-Policy: upgrade-insecure-requests"); ``` #nginx 强制让http的访问Https ``` server { #HTTP_TO_HTTPS_END ssl_certificate /etc/letsencrypt/live/yogayx.com/fullchain.pem; ssl_certificate_key /etc/letsencrypt/live/yogayx.com/privkey.pem; ssl_protocols TLSv1 TLSv1.1 TLSv1.2; ssl_ciphers ECDHE-RSA-AES128-GCM-SHA256:HIGH:!aNULL:!MD5:!RC4:!DHE; ssl_prefer_server_ciphers on; ssl_session_cache shared:SSL:10m; ssl_session_timeout 10m; add_header Content-Security-Policy "upgrade-insecure-requests;connect-src *"; error_page 497 https://$host$request_uri; } ``` #在经过反复测试后 ``` add_header Content-Security-Policy "upgrade-insecure-requests;connect-src *"; ``` 解决了全部问题，即消除全部警告，同时兼容了各种协议资源。 转自https://www.jianshu.com/p/62d7053d1e5d 标签: nginx, http, https 本作品采用 知识共享署名-相同方式共享 4.0 国际许可协议 进行许可。