title: How to configure Content-Policy-Security header on ExpressJs app?
body: <p>I'm want to create a link in my website who download a PDF file but I get a white window with:</p>
  <pre><code>Cannot GET /file
  </code></pre>
  <p>and a Content Security Policy (CSP) error:</p>
  <pre><code>Content Security Policy: The page settings prevented a resource from loading at inline (&quot;default-src&quot;).
  </code></pre>
  <p>I use ExpressJs and Nginx for the back-end.</p>
  <p>I've tried to set CSP default-src header like this in my app.js file:</p>
  <pre><code>//Headers setup
  app.use((req, res, next) =&gt; {
      res.setHeader('Content-Security-Policy',&quot;default-src 'self' https://www.mydomain.fr&quot;);
      next();
  });
  </code></pre>
  <p>i've also tried to add this in my .conf file in Nginx:</p>
  <pre><code>add_header Content-Security-Policy &quot;default-src 'self';&quot; always;
  </code></pre>
  <p>It is still not working. Do you have any idea what is wrong?</p>
  <p>My router:</p>
  <pre><code>const express = require('express');
  const router = express.Router();
  
  const fileController = require('../controllers/file');
  
  router.get('/', fileController.getFile);
  
  module.exports = router;
  </code></pre>
  <p>My controller:</p>
  <pre><code>const path = require('path');
  
  exports.getFile = (req, res, next) =&gt; {
      res.set({'Content-Type':'application/pdf'});
      res.set({'Content-Disposition':'attachment, filename=file.pdf'});
      const filePath = path.join(__dirname, '/public/documents/file.pdf');
      res.download(filePath, 'file.pdf', (e) =&gt; {res.status(404).json({e: e})});
  }
  </code></pre>