[系统运维]关于nginx配置项防止xss攻击的记录

server {
         ......
        
		//以下两种方式未生效
		add_header Content-Security-Policy "default-src 'self' localhost:80 'unsafe-inline' 'unsafe-eval' blob: data: ;";
		add_header X-XSS-Protection "1; mode=block";

        location / {
            ......
			
			//通过正则对输入内容进行拦截
			if ($query_string ~* (\$|'|--|[+|(%20)]union[+|(%20)]|[+|(%20)]insert[+|(%20)]|[+|(%20)]drop[+|(%20)]|[+|(%20)]truncate[+|(%20)]|[+|(%20)]update[+|(%20)]|[+|(%20)]from[+|(%20)]|[+|(%20)]grant[+|(%20)]|[+|(%20)]exec[+|(%20)]|[+|(%20)]where[+|(%20)]|[+|(%20)]select[+|(%20)]|[+|(%20)]and[+|(%20)]|[+|(%20)]or[+|(%20)]|[+|(%20)]count[+|(%20)]|[+|(%20)]exec[+|(%20)]|[+|(%20)]chr[+|(%20)]|[+|(%20)]mid[+|(%20)]|[+|(%20)]like[+|(%20)]|[+|(%20)]iframe[+|(%20)]|[\<|%3c]script[\>|%3e]|javascript|alert|webscan|dbappsecurity|style|confirm\(|innerhtml|innertext)(.*)$) { return 555; }
			if ($uri ~* (/~).*) { return 501; }
			if ($uri ~* (\\x.)) { return 501; }
			if ($query_string ~* "[;'<>].*") { return 509; }
			if ($request_uri ~ " ") { return 509; }
			if ($request_uri ~ (\/\.+)) { return 509; }
			if ($request_uri ~ (\.+\/)) { return 509; }
			if ($uri ~* (insert|select|delete|update|count|master|truncate|declare|exec|\*|\')(.*)$ ) { return 503; }
			
			
			
        }
}