Nginx配置“Content-Security-Policy”头、“X-XSS-Protection”头和“X-Content-Type-Options”头 如上图配置,文件位置:nginx/conf/nginx.conf add_header X-Frame-Options "SAMEORIGIN"; add_header X-XSS-Protection "1; mode=block"; add_header X-Content-Type-Options "nosniff"; add_header Content-Secur...
response.setHeader("Content-Security-Policy","script-src 'self' 'unsafe-inline' 'unsafe-eval' *.example.cn; style-src 'self' http://* 'unsafe-inline';"); //说明: //script-src 'self' 'unsafe-inline' 'unsafe-eval' *.example.cn; 代表代码只允许同源以及*.example.cn下的js资源(*代码通...