Nginx CSP example

100%

Nginx CSP example

✓ Published0🌍 Public

Last edited Mar 4, 2015

Created on Apr 17, 2023

This example demonstrates a hardened Nginx configuration that adds security headers to HTTP responses, including `X-Frame-Options`, `X-Content-Type-Options`, `X-XSS-Protection`, and a `Content-Security-Policy` directive. It shows how the server restricts resource loading to trusted domains like YouTube, Google APIs, and Facebook, while permitting inline scripts and styles. The configuration uses Nginx’s `add_header` directive to apply these policies globally, illustrating a practical approach to mitigating clickjacking, content sniffing, and cross-site scripting attacks. The file is a plain-text server config, not a visualization, and relies solely on Nginx’s built-in header functionality.

AI-generated description

Similar vizzes

Loading thumbnail…

Gist 6ed3f84640838d8320f6b209b1628e41

This example demonstrates a cross-site scripting (XSS) proof-of-concept that exfiltrates a visitor’s cookies. The code uses a raw JavaScript payload with `document.write` to inject an `<img>` tag, which fires a request to a user-supplied Ngrok URL, appending `document.cookie` as a query parameter. It shows a simple, direct attack vector for testing XSS vulnerabilities, relying on the browser’s automatic image request to send data to an external server. The visualization is the code itself, presented as a threat-modeling sample rather than a chart.

PPeleke

57% match

Loading thumbnail…

nginx hack for multiple conditions

This example shows how nginx uses a series of `if` directives to apply conditional logic for routing requests, combining string variables to form a composite test. It sets the `$test` variable progressively based on three conditions: the request URI being the root, the host matching `teambox.com`, and the absence of an `auth_token` cookie. When all conditions are met, the final `if` block directs the request to a Heroku-hosted CMS via `proxy_pass` and `break`. The code relies on nginx’s built-in rewrite module and string concatenation to evaluate the multi-part rule.

TThanad

57% match

Loading thumbnail…

Gist 055a86617685691db7632fcb10fb8bc8

This example demonstrates a simulated cross-site scripting (XSS) attack via remote file inclusion, visually rendering a PHP script’s output as an alert dialog that exposes `document.cookie`. The visualization uses a plain HTML page to embed the PHP snippet, with the code directly echoing a `<script>` tag that triggers the alert. It relies on the browser’s native JavaScript execution rather than external libraries, showing the raw mechanism of injecting client-side code through a server-side include. The rendering approach is minimal, presenting the source code and its resulting runtime behavior side by side.

PPeleke

54% match

Loading thumbnail…

Gist 6fc452a19facae4857d0

This example demonstrates the process of setting up mutual TLS (client-side SSL) authentication for web servers. It walks through generating self-signed certificates using the OpenSSL command-line tool, including creating a Certificate Authority root, client keys, and PKCS#12 or PEM conversions for browser and application use. The guide references nginx configuration directives such as `ssl_client_certificate` and `ssl_verify_client` to request and validate client certificates, and it links to external resources for integrating with backend applications. The gist is a textual reference, not a data visualization.

ZZJONSSON

53% match

Loading thumbnail…

How to apply CSP headers using Azure Frontdoor

This example demonstrates how to enforce Content-Security-Policy (CSP) headers on an Azure Front Door endpoint by defining a rule set in Bicep. It shows the creation of a rule that first deletes any existing CSP header from the backend, then appends separate directives for script, style, and font sources. The configuration uses the `Microsoft.Cdn/profiles/ruleSets/rules` API to add actions of type `ModifyResponseHeader`, and associates the rule set with a route via `Microsoft.Cdn/profiles/afdendpoints/routes`. The code relies on Azure Front Door’s resource definitions without external data sources.

MMasDenBy

53% match

Loading thumbnail…

Gist 884836

This visualization demonstrates an nginx configuration for proxying requests to a Node.js application running on port 8001. It shows the setup of an upstream server group named "node" and a server block listening on port 80, with access logging enabled. The code specifies root directory paths and includes fastcgi parameters while using proxy_pass to forward requests to the upstream. The example relies on nginx’s built-in HTTP proxy and FastCGI modules, with no external JavaScript libraries or rendering APIs involved.

Aalessioalex

51% match

Loading thumbnail…

Gist 41f7d0d837d1d40afd9f9b1d1f87d4ff

This example demonstrates a shell script that sets up a cloud-based development environment, installing code-server and configuring it with nginx as a reverse proxy. It shows the infrastructure provisioning process, including user creation, SSH key copying, and self-signed SSL certificate generation using openssl. The code uses bash commands, systemd services, and nginx configuration to enable remote access to a VS Code instance through a secure HTTPS connection, with a redirect server for the --link feature. The script relies on curl, apt, and standard Unix utilities rather than visualization libraries.

Aamazingandyyy

51% match

Loading thumbnail…

Gist 1b1889baaec2adffe574

This example demonstrates a WordPress theme’s strategy for optimizing CSS delivery by inlining critical styles and asynchronously loading the full stylesheet. It shows how PHP hooks like `wp_head` and `wp_footer` conditionally inject scripts, styles, and a cookie-based cache check. The code uses `file_get_contents` to embed JavaScript files such as `loadCSS.js` and `onloadCSS.js`, alongside a `<style>` block for critical CSS. A `noscript` fallback ensures the full stylesheet loads without JavaScript. The implementation relies on the `Roots\Sage\Assets` namespace and functions like `asset_path()` to resolve file paths.

GGolodhros

51% match