title: How to Override Content-Security-Policy of Site A while using nginx proxy_pass on Site B for serving content?
body: <p>Is there a way to override Content-Security-Policy set by the domain/site A while i am using nginx proxy_pass on Site B.</p>
  
  <pre><code>Site A defined Content-Security-Policy on their domain.
  Site B acts as a reverse proxy for site A.
  </code></pre>
  
  <p>How can i override Content-Security-Policy while serve content from site B ?</p>
  
  <p>how can i achieve this in nginx proxy pass ?</p>
  
  <p>my current nginx server block looks like this </p>
  
  <pre><code>server {
  server_name  proxy-domain.com.;
  
      location / {
        proxy_pass http://www.target-site.com/;
        proxy_set_header  Accept-Encoding ""; 
        proxy_set_header  X-Real-IP   $remote_addr;   
        proxy_set_header  X-Forwarded-For $proxy_add_x_forwarded_for;
     }
  }
  </code></pre>
  
  <p>i have tried adding </p>
  
  <p>add_header Content-Security-Policy "default-src 'self' 'unsafe-inline' 'unsafe-eval' </p>
  
  <p>e.g.</p>
  
  <pre><code>server {
  server_name  proxy-domain.com.;
  
      location / {
        proxy_pass http://www.target-site.com/;
        proxy_set_header  Accept-Encoding ""; 
        proxy_set_header  X-Real-IP   $remote_addr;   
        proxy_set_header  X-Forwarded-For $proxy_add_x_forwarded_for;
     }
  add_header Content-Security-Policy "default-src 'self' 'unsafe-inline' 'unsafe-eval'
  }
  </code></pre>
  
  <p>but if i check headers of site B, then it shows modified Content-Security-Policy of site B but the content from other sources does not gets loaded., only headers are set.</p>
  
  <p>why is that ?</p>
  
  <p>update:
  when i check headers i get 2 Content-Security-Policy headers , first are set by site A and then later one Content-Security-Policy headers set be my i.e. site B.</p>
  
  <p>e.g.</p>
  
  <pre><code>Content-Security-Policy: default-src 'self' 'unsafe-inline' 'unsafe-eval' apis.google.com www.google.com;
  Content-Security-Policy: default-src 'self' 'unsafe-inline' 'unsafe-eval' *.cloudflare.com;
  </code></pre>