我是使用 NGINX 和 Magento 2 的新手，并且 CSP 标头有一些问题。希望我能在这里找到帮助。过去我使用 Apache 和 CentOS，但我将在 NGINX 上运行网络服务器到未来。
首先，我在 Ubuntu 20.04 上使用 MariaDB 和 PHP 7.4 运行 NGINX。我的 Magento 2 在 2.4.3-p1 上运行。该网站正在正常加载。但在控制台中，我找到了 CSP 警告的以下条目：
内容安全政策：此网站有一个仅报告规则，没有报告 URI。CSP 不会阻止任何内容，也无法报告任何违反此规则的行为。
内容安全策略：https://unsafe-inline 被解释为主机名，而不是关键字。如果这是关键字，请使用“unsafe-inline”（用单引号括起来）。
我的站点配置中包含以下标头：
add_header X-Processing-Time $request_time always;
add_header X-Request-ID $request_id always;
add_header X-UA-Compatible "IE=Edge,chrome=1";
add_header Referrer-Policy "no-referrer" always;
add_header Referrer-Policy "no-referrer no-referrer-when-downgrade strict-origin strict-origin-when-cross-origin same-origin";
add_header Strict-Transport-Security "max-age=15552000; includeSubDomains; preload";
add_header X-Robots-Tag none;
add_header X-Frame-Options SAMEORIGIN always;
add_header X-Content-Type-Options nosniff always;
add_header X-XSS-Protection "1; mode=block" always;
add_header Content-Security-Policy "default-src 'self' https://google.com https://youtube.com https://facebook.com https://fonts.google.com https://fonts.googleapis.com https://ajax.googleapis.com https://www.google-analytics.com https://cdnjs.cloudflare.com https://code.jquery.com https://connect.facebook.net; img-src 'self'; style-src 'self' 'unsafe-inline'; script-src 'self' 'unsafe-inline' 'unsafe-eval'; connect-src 'self'; font-src 'self'; object-src 'self'; report-uri /csp-report; media-src 'self'; form-action 'self'; frame-ancestors 'self';" always;
我已经对此进行了研究，但找不到任何解决此问题的方法。
怎么了？如何解决这个问题？如果您需要更多信息，我可以将其粘贴在这里 - 随便问。
有人可以帮我解决这个问题吗？我对每一个解决方案都感到非常高兴。
谢谢你。~Bendeluxe
更新：
我完全糊涂了...我重新设置了所有内容，但仍然是我上面提到的相同警告。我不知道如何解决它...
这是我的标题：
Server nginx
Date Sat, 18 Dec 2021 13:26:32 GMT
Content-Type text/html; charset=UTF-8
Transfer-Encoding chunked
Connection keep-alive
Vary Accept-Encoding
Set-Cookie PHPSESSID=d63jrgjpfk9gqld170in5japk0; expires=Sat, 18-Dec-2021 14:26:32 GMT; Max-Age=3600; path=/; domain=mydomain; secure; HttpOnly; SameSite=Lax
Pragma no-cache
Cache-Control max-age=0, must-revalidate, no-cache, no-store
Expires Fri, 18 Dec 2020 13:10:29 GMT
Content-Security-Policy-Report-Only font-src *.yotpo.com *.googleapis.com *.gstatic.com data: 'self' 'unsafe-inline'; form-action secure.authorize.net test.authorize.net geostag.cardinalcommerce.com geo.cardinalcommerce.com 1eafstag.cardinalcommerce.com 1eaf.cardinalcommerce.com centinelapistag.cardinalcommerce.com centinelapi.cardinalcommerce.com pilot-payflowlink.paypal.com *.amazon.com *.amazon.co.uk *.amazon.co.jp *.amazon.jp *.amazon.it *.amazon.fr *.amazon.es *.amazon.de *.yotpo.com 'self' 'unsafe-inline'; frame-ancestors 'self'; frame-src fast.amc.demdex.net *.adobe.com secure.authorize.net test.authorize.net geostag.cardinalcommerce.com geo.cardinalcommerce.com 1eafstag.cardinalcommerce.com 1eaf.cardinalcommerce.com centinelapistag.cardinalcommerce.com centinelapi.cardinalcommerce.com www.paypal.com www.sandbox.paypal.com pilot-payflowlink.paypal.com player.vimeo.com *.youtube.com https://www.google.com/recaptcha/ *.amazon.com *.amazon.co.uk *.amazon.co.jp *.amazon.jp *.amazon.it *.amazon.fr *.amazon.es *.amazon.de *.payments-amazon.com *.payments-amazon.co.uk *.payments-amazon.co.jp *.payments-amazon.jp *.payments-amazon.it *.payments-amazon.fr *.payments-amazon.es *.payments-amazon.de *.dotdigital-pages.com *.dotdigital.com cdn.dnky.co webchat.dotdigital.com c.paypal.com checkout.paypal.com assets.braintreegateway.com pay.google.com *.cardinalcommerce.com *.yotpo.com 'self' 'unsafe-inline'; img-src assets.adobedtm.com amcglobal.sc.omtrdc.net dpm.demdex.net cm.everesttech.net *.adobe.com widgets.magentocommerce.com data: www.googleadservices.com www.google-analytics.com www.paypalobjects.com t.paypal.com *.ftcdn.net *.behance.net www.paypal.com fpdbs.paypal.com fpdbs.sandbox.paypal.com *.vimeocdn.com i.ytimg.com d3sbl0c71oxeok.cloudfront.net dhkkzdfmpzvap.cloudfront.net d2bpzs5y44q6e0.cloudfront.net d37shgu97oizpd.cloudfront.net d1zlqll3enr74n.cloudfront.net d1jynp0fpwn93a.cloudfront.net d2cb3tokgpwh3v.cloudfront.net d1re8bfxx3pw6e.cloudfront.net d35u8xwkxs8vpe.cloudfront.net d13s9xffygp5o.cloudfront.net d388nbw0dwi1jm.cloudfront.net d11p2vtu3dppaw.cloudfront.net d3r89hiip86hka.cloudfront.net dc7snq0c8ipyk.cloudfront.net d5c7kvljggzso.cloudfront.net d2h8yg3ypfzua1.cloudfront.net d1b556x7apj5fb.cloudfront.net draz1ib3z71v2.cloudfront.net dr6hdp4s5yzfc.cloudfront.net d2bomicxw8p7ii.cloudfront.net d3aypcdgvjnnam.cloudfront.net d2a3iuf10348gy.cloudfront.net *.ssl-images-amazon.com *.ssl-images-amazon.co.uk *.ssl-images-amazon.co.jp *.ssl-images-amazon.jp *.ssl-images-amazon.it *.ssl-images-amazon.fr *.ssl-images-amazon.es *.ssl-images-amazon.de *.media-amazon.com *.media-amazon.co.uk *.media-amazon.co.jp *.media-amazon.jp *.media-amazon.it *.media-amazon.fr *.media-amazon.es *.media-amazon.de www.sandbox.paypal.com b.stats.paypal.com dub.stats.paypal.com assets.braintreegateway.com c.paypal.com checkout.paypal.com *.yotpo.com data: 'self' 'unsafe-inline'; script-src assets.adobedtm.com *.adobe.com secure.authorize.net test.authorize.net www.googleadservices.com www.google-analytics.com www.paypalobjects.com js.braintreegateway.com www.paypal.com geostag.cardinalcommerce.com 1eafstag.cardinalcommerce.com geoapi.cardinalcommerce.com 1eafapi.cardinalcommerce.com songbird.cardinalcommerce.com includestest.ccdc02.com www.sandbox.paypal.com t.paypal.com s.ytimg.com www.googleapis.com vimeo.com www.vimeo.com *.vimeocdn.com https://www.gstatic.com/recaptcha/ https://www.google.com/recaptcha/ *.payments-amazon.com *.payments-amazon.co.uk *.payments-amazon.co.jp *.payments-amazon.jp *.payments-amazon.it *.payments-amazon.fr *.payments-amazon.es *.payments-amazon.de *.trackedlink.net *.trackedweb.net *.dotdigital-pages.com cdn.dnky.co webchat.dotdigital.com assets.braintreegateway.com c.paypal.com pay.google.com api.braintreegateway.com api.sandbox.braintreegateway.com client-analytics.braintreegateway.com client-analytics.sandbox.braintreegateway.com *.yotpo.com 'self' 'unsafe-inline' 'unsafe-eval'; style-src *.adobe.com cdn.dnky.co webchat.dotdigital.com unsafe-inline *.yotpo.com *.googleapis.com 'self' 'unsafe-inline'; object-src 'self' 'unsafe-inline'; media-src *.adobe.com 'self' 'unsafe-inline'; manifest-src 'self' 'unsafe-inline'; connect-src dpm.demdex.net amcglobal.sc.omtrdc.net www.google-analytics.com geostag.cardinalcommerce.com geo.cardinalcommerce.com 1eafstag.cardinalcommerce.com 1eaf.cardinalcommerce.com centinelapistag.cardinalcommerce.com centinelapi.cardinalcommerce.com www.sandbox.paypal.com www.paypalobjects.com www.paypal.com *.amazon.com *.amazon.co.uk *.amazon.co.jp *.amazon.jp *.amazon.it *.amazon.fr *.amazon.es *.amazon.de *.amazonpay.com *.amazonpay.co.uk *.amazonpay.co.jp *.amazonpay.jp *.amazonpay.it *.amazonpay.fr *.amazonpay.es *.amazonpay.de mws.amazonservices.com mws.amazonservices.co.uk mws.amazonservices.co.jp mws.amazonservices.jp mws.amazonservices.it mws.amazonservices.fr mws.amazonservices.es mws.amazonservices.de *.trackedlink.net *.trackedweb.net *.dotdigital-pages.com webchat.dotdigital.com api.braintreegateway.com api.sandbox.braintreegateway.com client-analytics.braintreegateway.com client-analytics.sandbox.braintreegateway.com *.braintree-api.com *.yotpo.com 'self' 'unsafe-inline'; child-src assets.braintreegateway.com c.paypal.com http: https: blob: 'self' 'unsafe-inline'; default-src 'self' 'unsafe-inline' 'unsafe-eval'; base-uri 'self' 'unsafe-inline';
X-Content-Type-Options nosniff
X-XSS-Protection 1; mode=block
X-Frame-Options SAMEORIGIN
Strict-Transport-Security max-age=31536000
Content-Encoding
我真的不明白为什么上面提到的两个警告都会出现。如果我换行：
add_header Content-Security-Policy "default-src 'self'....
在我的 nginx 站点配置中并更改为“self”，而不是阻止所有 rexternal 规则。如果我添加 ie https://www.google.com比谷歌也将被接受。
我需要将所有 add_header 粘贴到 oneliner 中吗？所以所有这些标题：
add_header X-Processing-Time $request_time always;
add_header X-Request-ID $request_id always;
add_header X-UA-Compatible "IE=Edge,chrome=1";
add_header Referrer-Policy "no-referrer" always;
add_header Referrer-Policy "no-referrer no-referrer-when-downgrade strict-origin strict-origin-when-cross-origin same-origin";
add_header Strict-Transport-Security "max-age=15552000; includeSubDomains; preload";
add_header X-Robots-Tag none;
add_header X-Frame-Options SAMEORIGIN always;
add_header X-Content-Type-Options nosniff always;
add_header X-XSS-Protection "1; mode=block" always;
add_header Content-Security-Policy "default-src 'self' https://google.com https://youtube.com https://facebook.com https://fonts.google.com https://fonts.googleapis.com https://ajax.googleapis.com https://www.google-analytics.com https://cdnjs.cloudflare.com https://code.jquery.com https://connect.facebook.net; img-src 'self'; style-src 'self' 'unsafe-inline'; script-src 'self' 'unsafe-inline' 'unsafe-eval'; connect-src 'self'; font-src 'self'; object-src 'self'; report-uri /csp-report; media-src 'self'; form-action 'self'; frame-ancestors 'self';" always;
可能只有一行？也可能导致网络文件夹中的 .htaccess 导致一些标题错误？我没有更改任何内容，但默认情况下 /var/www/mydomain/ 文件夹中有一些 htaccess 文件。
我希望有人可以指导我解决我的问题。如果有人可以提供帮助，我真的很高兴。
谢谢你。