Resolved Applying Content Security Policy (CSP)

[learning_curve]

We have searched in this Plesk Onyx section for the correct way to apply this through nginx, but can't find any specific details. Outside of this forum, there's plenty of reference material and nearly all the nginx formats used / recommended out there provide this as a simple, starting point:

add_header Content-Security-Policy "default-src 'self';”;

which we ammeded to this non-active version, so that we can see all the issues as they happen:

add_header Content-Security-Policy-Report-Only "default-src 'self';”;

Using either of these however (after adding them via Plesk Panel / Domain / Apache & nginx settings always provides the same error:

...unexpected end of file, expecting ";" or "}" in /var/www/vhosts/system/[TEST-DOMAIN]/conf/vhost_nginx.conf:15
nginx: configuration file /etc/nginx/nginx.conf test failed

It's clearly, a simple typo by us somewhere, but we've tried many different permuations and even a different approach, by creating a new additional .conf file here: /etc/nginx/conf.d but that also produces the same error, so we're stuck There's no detrimental affect on our server because the linked nginx test fails and reports everyting before we re-start nginx, which is nice.

We'd like to run this 'starting point' successfully before we experiment with the many additional suffix instructions as CSP is now at level 2 (Content Security Policy CSP Reference & Examples ). If anyone can see what we can't see or, suggest a different Plesk focused format, that would be great and well received.

 

[UFHH01]

Hi learning_curve,

sometimes "someone is unable to see the wood for the trees"

;”;

Pls. correct this to a simple ";"

 

[learning_curve]

Hahahahahaha Yes, we've looked at plenty of trees, but the missing wood mystery continues...
The original ending

;";

is exactly as you'll see it on all external references - a litttle odd but we followed it

If we now try

add_header Content-Security-Policy-Report-Only "default-src 'self'";"

which we think you meant in your post, or even

add_header Content-Security-Policy-Report-Only "default-src 'self';";"

it's still the same error... We did try quite a lot of permutations previously but we cannot find one that will run without an error...

 

[UFHH01]

Hi learning_curve,

naaaa....

add_header Content-Security-Policy-Report-Only "default-src 'self'";

Just to clarify:

if you OPEN with " , you have to close with " and if you open with ' , you have to close with ' and the ENDING of each directive is always a ; . I tried to highlight the ; with my quotes, but this doesn't mean, that you should use it! ( I wonder from wich source you are taking suggestions. ^^ )

 

[learning_curve]

Yes, totally familiar with and agree with those logic statements.
That's why this was/is puzzling!
Please have a look at these two example images:
CPS Reference Guide: Dropbox - CPS Reference Guide.png
Sitepoint: Dropbox - Sitepoint.png
There's more but all are the same (so far...) with links if needed
They appear to contradict the logic above slightly and despite closing with a

;

they produce the errors shown above, which is why we were temporily stuck and asked the question

 

[learning_curve]

The example you have added above works perfectly thank you. It's how we thought it should be, but didn't because of the reasons (guidance) in our last post above

So we'll stick to Plesk Forum guidance and that will be better