Nginx – Content-Security-Policy issues (NGINX)

nginx

I am working with NGINX and I have a couple issues here.

I have a domain and one subdomain

Server block for domain

listen       80;
server_name  just4bettors.mobi  www.just4bettors.mobi;
root   /home/c0pt/capilleira/capilleiraclickandgamblemobile/www

Server block for subdomain

listen 80;
server_name www.desktop.just4bettors.mobi desktop.just4bettors.mobi;
root   /home/c0pt/capilleira/capilleiraclickandgambleweb/dist;

for the domain everything works properly, you can access to the page and log and there is nothing wrong, but once you try to enter to the subdomain, you can see an error on the screen Server not found when you enter http://www.desktop.just4bettors.mobi, and when you enter http://desktop.just4bettors.mobi you get GET http://desktop.just4bettors.mobi/ net::ERR_NAME_NOT_RESOLVED

Content-Security-Policy for domain

add_header Content-Security-Policy
  "default-src 'self';
  script-src 'self' 'unsafe-inline' 'unsafe-eval';
  style-src 'self' 'unsafe-inline' https://fonts.googleapis.com  https://themes.googleusercontent.com https://fonts.gstatic.com https://assets.zendesk.com;
  object-src 'none';
  connect-src http://just4bettors.mobi http://just4bettors.mobi:1337 http://www.just4bettors.mobi;";

now these are the Content-Security-Policy for the sub-domain

add_header Content-Security-Policy
  "default-src 'self';
  script-src 'self' 'unsafe-inline' 'unsafe-eval' http://www.just4bettors.mobi http://www.desktop.just4bettors.mobi;
  style-src 'self' 'unsafe-inline'
  object-src 'none';
  connect-src http://desktop.just4bettors.mobi http://www.desktop.just4bettors.mobi;";

so, what am I missing ? basically, the question would be: why I can not access to the subdomain ?

PD: all the DNS part is done already.

Best Answer

You said that: "all the DNS part is done already." In fact, all the DNS part is not done already. We can clearly see:

$ host just4bettors.mobi
just4bettors.mobi has address 190.171.28.156
$ host www.just4bettors.mobi
www.just4bettors.mobi has address 190.171.28.156
$ host desktop.just4bettors.mobi
Host desktop.just4bettors.mobi not found: 3(NXDOMAIN)
$ host www.desktop.just4bettors.mobi
Host www.desktop.just4bettors.mobi not found: 3(NXDOMAIN)

You just need to set up your DNS records correctly.

Related Solutions

Nginx – Properly setting up a “default” nginx server for https

I managed to configure a shared dedicated hosting on a single IP with nginx. Default HTTP and HTTPS serving a 404 for unknown domains incoming.

1 - Create a default zone

As nginx is loading vhosts in ascii order, you should create a 00-default file/symbolic link into your /etc/nginx/sites-enabled.

2 - Fill the default zone

Fill your 00-default with default vhosts. Here is the zone i am using:

server {
    server_name _;
    listen       80  default_server;
    return       404;
}


server {
    listen 443 ssl;
    server_name _;
    ssl_certificate /etc/nginx/ssl/nginx.crt;
    ssl_certificate_key /etc/nginx/ssl/nginx.key;
    return       404;
}

3 - Create self signed certif, test, and reload

You will need to create a self signed certificate into /etc/nginx/ssl/nginx.crt.

Create a default self signed certificate:

sudo openssl req -x509 -nodes -days 365 -newkey rsa:2048 -keyout /etc/nginx/ssl/nginx.key -out /etc/nginx/ssl/nginx.crt

Just a reminder:

Test the nginx configuration before reloading/restarting : nginx -t
Reload a enjoy: sudo service nginx reload

Hope it helps.

Nginx – CSP nginx nonce

It is not enough to modify your nginx configuration in order to use nonces.

Nonces must be generated for each request, so that attackers cannot know them (otherwise, they can just inject a script/resource with the same nonce).

Hence:

If you’re using nginx as a reverse-proxy, your application (behind nginx) must be modified in such a way that it will generate a nonce, add that nonce to all <script> blocks and <style> blocks in its output and serve the corresponding CSP header.
If you’re using nginx to serve static files, move <script> and <style> contents into separate files, compute their hash, and use the hash instead.

Now, having answered the generic question, let’s talk specifics. From your error message, I think you’re talking about //pagead2.googlesyndication.com/pagead/js/adsbygoogle.js. That script seems to be using inline styles, but isn’t under your control, so you can’t use nonces. Aside from asking Google to change the script, I don’t see what you could do.

Best Answer

Related Solutions

Nginx – Properly setting up a “default” nginx server for https

Nginx – CSP nginx nonce

Related Topic