Fix · Express / Node
Fix “CSP strength” on Express / Node
Remove 'unsafe-inline'/'unsafe-eval' from script-src (use nonces or hashes), drop wildcards, add object-src 'none' and base-uri 'self'. Roll out with Content-Security-Policy-Report-Only first.
res.setHeader("Content-Security-Policy", "default-src 'self'; object-src 'none'; base-uri 'self'; frame-ancestors 'none'");Verify the fix
Re-run the CSP strength check after deploying. Test config changes in staging first and keep a rollback: a wrong header can break a site faster than a missing one.
Other stacks: nginx · Apache · Caddy · Cloudflare