title: content security policy (csp) issue for subdomain with nginx as reverse proxy and node express as backand
body: <p>I have an issue with content security policy headers. Scripts and styles are blocked.</p>
  
  <p>It seams that nginx is overloading my express headers.</p>
  
  <p>I tried a lot and my last state is this.</p>
  
  <p>nginx server block</p>
  
  <pre><code>...
  location / {
      proxy_pass http://127.0.0.1:3000;
      proxy_http_version 1.1;
      proxy_cache_bypass $http_upgrade;
  
      proxy_set_header Upgrade $http_upgrade;
      proxy_set_header Connection 'upgrade';
      proxy_set_header Host $host;
      proxy_set_header x-real-ip $remote_addr;
      proxy_set_header X-Forwarded-For   $proxy_add_x_forwarded_for;
      proxy_set_header X-Forwarded-Proto $scheme;
      proxy_set_header X-Forwarded-Host  $host;
      proxy_set_header X-Forwarded-Port  $server_port;
  }
  ....
  </code></pre>
  
  <p>express setup (domain name is changed to example.com)</p>
  
  <pre><code>const express = require('express');
  const lusca = require('lusca');
  const app = express();
  ...
  app.use(lusca.xframe('SAMEORIGIN'));
  app.use(lusca.xssProtection(true));
  app.use(
    lusca.csp({
      policy: {
        "default-src": "'self' *.example.com",
        "img-src": "*"
      }
    })
  );
  ...
  </code></pre>
  
  <p>In the browser console I get this:</p>
  
  <pre><code>content security policy the page’s settings blocked the loading of a resource at ("default-src")
  content security policy the page’s settings blocked the loading of a resource at ("script-src")
  content security policy the page’s settings blocked the loading of a resource at ("style-src")
  </code></pre>
  
  <p>In broswsers answer field (csp is twice!):</p>
  
  <pre><code>content-security-policy: default-src 'self' *.example.com; img-src *
  content-security-policy: default-src 'none'; frame-ancestors 'none'; script-src 'self'; img-src 'self'; style-src 'self'; base-uri 'self'; form-action 'self';
  </code></pre>
  
  <p>Does anyone have an idea why this configuration is not working? Or how to tell nginx to use express's headers and hold down the own?</p>