# \#csp **URL:** https://help.nextcloud.com/tag/csp/740.md [Latest](https://help.nextcloud.com/latest.md) · [Categories](https://help.nextcloud.com/categories.md) · [Tags](https://help.nextcloud.com/tags.md) --- ## [CSP "Content Security Policy" missing in Nextcloud manual](https://help.nextcloud.com/t/csp-content-security-policy-missing-in-nextcloud-manual/207822)
**Author:** [@carloscomputer](https://help.nextcloud.com/u/carloscomputer)\ **Replies:** 6\ **Last updated:** [May 31, 2026, 7:22am UTC](https://help.nextcloud.com/t/csp-content-security-policy-missing-in-nextcloud-manual/207822 "2026-05-31T07:22:31Z")
Warning: this is a security related topic. Please read the complete discussion before blindly copying configuration settings. CSP missing in Nextcloud Nginx docs configuration manual: https://docs.nextcloud.com/server/… --- ## [CSP Wildcard Directives (frame-src \*, img-src \*, media-src \*, connect-src \*)](https://help.nextcloud.com/t/csp-wildcard-directives-frame-src-img-src-media-src-connect-src/241052)
**Author:** [@adelacruz](https://help.nextcloud.com/u/adelacruz)\ **Replies:** 4\ **Last updated:** [April 14, 2026, 3:02pm UTC](https://help.nextcloud.com/t/csp-wildcard-directives-frame-src-img-src-media-src-connect-src/241052 "2026-04-14T15:02:11Z")
Is there way to fix this on Nextcloud Hub 25 Autumn (32.0.6)? This report was on the ZAP Report “Content Security Policy (CSP) is an added layer of security that helps to detect and mitigate certain types of attacks. I… --- ## [Authorize a Nextcloud agenda to show in another website](https://help.nextcloud.com/t/authorize-a-nextcloud-agenda-to-show-in-another-website/242159)
**Author:** [@pierr0t1](https://help.nextcloud.com/u/pierr0t1)\ **Replies:** 0\ **Last updated:** [March 20, 2026, 2:40pm UTC](https://help.nextcloud.com/t/authorize-a-nextcloud-agenda-to-show-in-another-website/242159 "2026-03-20T14:40:23Z")
▶ Hello, I’m not providing all the tech information as I think it’s not exactly relevant to my question (I can say up to date NC with agenda). I’am asked about the possibility to display a Nextcloud Agenda into the pag… --- ## [Unable to reach Collabora Server (docker)](https://help.nextcloud.com/t/unable-to-reach-collabora-server-docker/241401)
**Author:** [@Taxicletter](https://help.nextcloud.com/u/Taxicletter)\ **Replies:** 13\ **Last updated:** [March 13, 2026, 1:40pm UTC](https://help.nextcloud.com/t/unable-to-reach-collabora-server-docker/241401 "2026-03-13T13:40:11Z")
The Basics Nextcloud Server version (e.g., 29.x.x): Nextcloud Hub 25 Autumn (32.0.6) Operating system and version (e.g., Ubuntu 24.04): Linux 6.12.73+deb13-amd64 x86\_64 Web server and version (e.g, Apache 2.4.25):… --- ## [Content Security Policy blocking script](https://help.nextcloud.com/t/content-security-policy-blocking-script/220998)
**Author:** [@socialistpizza](https://help.nextcloud.com/u/socialistpizza)\ **Replies:** 6\ **Last updated:** [January 19, 2026, 10:00am UTC](https://help.nextcloud.com/t/content-security-policy-blocking-script/220998 "2026-01-19T10:00:08Z")
I’m trying to integrate the Stripe API into my nextcloud custom app. But the content security policy is blocking the script. There are errors in the console: Within my nextcloud files I found a file for configuring … --- ## [Calender issue with NC32](https://help.nextcloud.com/t/calender-issue-with-nc32/235486)
**Author:** [@markus2330](https://help.nextcloud.com/u/markus2330)\ **Replies:** 12\ **Last updated:** [December 3, 2025, 2:38pm UTC](https://help.nextcloud.com/t/calender-issue-with-nc32/235486 "2025-12-03T14:38:37Z")
▶ Support intro Dear Nextcloud Community, we¹ are currently developing PermaplanT, a web app that should support sustainable and bio-diverse gardening. We heavily integrated Nextcloud, to be used for files, chats etc. to… --- ## [Solved: Nextcloud unable to load CSS, login page shows '{productName}'](https://help.nextcloud.com/t/solved-nextcloud-unable-to-load-css-login-page-shows-productname/232050)
**Author:** [@frankt](https://help.nextcloud.com/u/frankt)\ **Replies:** 2\ **Last updated:** [September 14, 2025, 8:15pm UTC](https://help.nextcloud.com/t/solved-nextcloud-unable-to-load-css-login-page-shows-productname/232050 "2025-09-14T20:15:05Z")
▶ Support intro The Basics Nextcloud Server version (e.g., 29.x.x): Nextcloud Hub 10 (31.0.9) Operating system and version (e.g., Ubuntu 24.04): AlmaLinux 8.10 Web server and version (e.g, Apache 2.4.25): 2.… --- ## [Enabling apps generates an http url despite being served over https](https://help.nextcloud.com/t/enabling-apps-generates-an-http-url-despite-being-served-over-https/221849)
**Author:** [@norseghost](https://help.nextcloud.com/u/norseghost)\ **Replies:** 4\ **Last updated:** [April 27, 2025, 9:25am UTC](https://help.nextcloud.com/t/enabling-apps-generates-an-http-url-despite-being-served-over-https/221849 "2025-04-27T09:25:18Z")
more accurate description of previous issue up to date nextcloud, running off the php-fpm docker compose stack when I try and enable an app from the app store, I get the error; Refused to connect to 'http://cloud.ande… --- ## [Configuring CSP in Nextcloud for Server Hardening](https://help.nextcloud.com/t/configuring-csp-in-nextcloud-for-server-hardening/222063)
**Author:** [@mb19](https://help.nextcloud.com/u/mb19)\ **Replies:** 2\ **Last updated:** [April 8, 2025, 8:06am UTC](https://help.nextcloud.com/t/configuring-csp-in-nextcloud-for-server-hardening/222063 "2025-04-08T08:06:02Z")
Hello, I’m currently working on hardening my Nextcloud server and I have a few questions regarding the configuration of “Content Security Policy (CSP)”. I’ve read that Nextcloud handles CSP internally through PHP, not … --- ## [CSP errors preventing login and app installation (yet again)](https://help.nextcloud.com/t/csp-errors-preventing-login-and-app-installation-yet-again/221694)
**Author:** [@norseghost](https://help.nextcloud.com/u/norseghost)\ **Replies:** 7\ **Last updated:** [April 3, 2025, 2:24pm UTC](https://help.nextcloud.com/t/csp-errors-preventing-login-and-app-installation-yet-again/221694 "2025-04-03T14:24:42Z")
TLDR; internal app requests are not being rewritten to https; violating CSP; despite overwrite\* settings being set I’m using the versions of nextcloud (30.x.x) with the php-fpm and nginx config from the nextcloud docker… --- ## [Nextcloud Signaling Backend - Failed to establish signaling connection](https://help.nextcloud.com/t/nextcloud-signaling-backend-failed-to-establish-signaling-connection/140191)
**Author:** [@linus777](https://help.nextcloud.com/u/linus777)\ **Replies:** 5\ **Last updated:** [April 3, 2025, 12:02pm UTC](https://help.nextcloud.com/t/nextcloud-signaling-backend-failed-to-establish-signaling-connection/140191 "2025-04-03T12:02:11Z")
Sachlage: Ich habe einen Nextcloud Server (Version Nextcloud Hub II, 23.0.0), sowie einen frisch eingerichteten Backendserver für die Talk-App über Docker Compose wie in diesem Text beschrieben: How to Install Nextcloud … --- ## [Nginx proxy - missing headers X-Frame-Options, X-Content-Type-Options and \_\_Host prefix on https://scan.nextcloud.com](https://help.nextcloud.com/t/nginx-proxy-missing-headers-x-frame-options-x-content-type-options-and-host-prefix-on-https-scan-nextcloud-com/219625)
**Author:** [@DanSman](https://help.nextcloud.com/u/DanSman)\ **Replies:** 11\ **Last updated:** [March 13, 2025, 8:16am UTC](https://help.nextcloud.com/t/nginx-proxy-missing-headers-x-frame-options-x-content-type-options-and-host-prefix-on-https-scan-nextcloud-com/219625 "2025-03-13T08:16:07Z")
Hi I’ve AIO running on a debian server behind nginx proxy. So far, everything seems to work fine apart of the scan. Below is the nginx config I use: map $http\_upgrade $connection\_upgrade { default upgrade; '' … --- ## [How to updates CSP policy via environment variables (Docker)](https://help.nextcloud.com/t/how-to-updates-csp-policy-via-environment-variables-docker/115795)
**Author:** [@Yaya911](https://help.nextcloud.com/u/Yaya911)\ **Replies:** 2\ **Last updated:** [December 6, 2024, 7:48pm UTC](https://help.nextcloud.com/t/how-to-updates-csp-policy-via-environment-variables-docker/115795 "2024-12-06T19:48:26Z")
I need to update nextcloud’s CSP default settings to allow form-action submission from sub-domains such as login.site.com, app.site.com and so on. Nextcloud is hosted as cloud.site.com. Using latest nextcloud from docke… --- ## [Hide header when embeding appointment in iframe](https://help.nextcloud.com/t/hide-header-when-embeding-appointment-in-iframe/212142)
**Author:** [@disgustipated](https://help.nextcloud.com/u/disgustipated)\ **Replies:** 7\ **Last updated:** [January 11, 2025, 12:22pm UTC](https://help.nextcloud.com/t/hide-header-when-embeding-appointment-in-iframe/212142 "2025-01-11T12:22:10Z")
I’m successfully displaying the appointment scheduling page in an iframe on a separate website. I’m trying to hide the header that displays in the iframe but cant figure out what needs to be added. when im using dev tool… --- ## [About CSP policy in apache2 sites-conf](https://help.nextcloud.com/t/about-csp-policy-in-apache2-sites-conf/211235)
**Author:** [@3417\_Trisorn\_Thanamo](https://help.nextcloud.com/u/3417_Trisorn_Thanamo)\ **Replies:** 0\ **Last updated:** [November 30, 2024, 12:55pm UTC](https://help.nextcloud.com/t/about-csp-policy-in-apache2-sites-conf/211235 "2024-11-30T12:55:53Z")
▶ Support intro Some or all of the below information will be requested if it isn’t supplied; for fastest response please provide as much as you can. :heart: The Basics Nextcloud Server version (e.g., 29.x.x): 30.0.2.2 … --- ## [Different nonces in CSP header and in HTML](https://help.nextcloud.com/t/different-nonces-in-csp-header-and-in-html/36332)
**Author:** [@revertron](https://help.nextcloud.com/u/revertron)\ **Replies:** 3\ **Last updated:** [November 23, 2024, 6:49pm UTC](https://help.nextcloud.com/t/different-nonces-in-csp-header-and-in-html/36332 "2024-11-23T18:49:29Z")
Hi all, I use: Nextcloud version (eg, 12.0.2): 13.0.6 Operating system and version (eg, Ubuntu 17.04): Debian 9 Apache or nginx version (eg, Apache 2.4.25): Nginx 1.14 PHP version (eg, 7.1): 7.0.30-0+deb9u1 The iss… --- ## [CSP for scripts from google.com not working any more](https://help.nextcloud.com/t/csp-for-scripts-from-google-com-not-working-any-more/210461)
**Author:** [@andreas](https://help.nextcloud.com/u/andreas)\ **Replies:** 2\ **Last updated:** [November 22, 2024, 11:39am UTC](https://help.nextcloud.com/t/csp-for-scripts-from-google-com-not-working-any-more/210461 "2024-11-22T11:39:27Z")
For many years, this code used to work, as suggested by the docs Controllers — Nextcloud latest Developer Manual latest documentation PageController.php: $response = new TemplateResponse('myApp', 'main', $params) $csp … --- ## [CSP CSS and Javacript block](https://help.nextcloud.com/t/csp-css-and-javacript-block/207568)
**Author:** [@Karumonix](https://help.nextcloud.com/u/Karumonix)\ **Replies:** 1\ **Last updated:** [October 23, 2024, 10:01pm UTC](https://help.nextcloud.com/t/csp-css-and-javacript-block/207568 "2024-10-23T22:01:24Z")
Hi, new to NextCloud. I created an index doing simple code and created folder with my files. link rel=“stylesheet” type=“text/css” href=“/css/datatables.css” script type=“text/javascript” src=“/src/datatables.js” but … --- ## [SOLVED: Nextcloud 16 - How to allow iFrame usage](https://help.nextcloud.com/t/solved-nextcloud-16-how-to-allow-iframe-usage/52278)
**Author:** [@adx442](https://help.nextcloud.com/u/adx442)\ **Replies:** 18\ **Last updated:** [July 5, 2024, 10:15am UTC](https://help.nextcloud.com/t/solved-nextcloud-16-how-to-allow-iframe-usage/52278 "2024-07-05T10:15:16Z")
SOLUTION: I needed the original patch for response.php, plus modifying /var/www/nextcloud/lib/public/AppFramework/Http/ContentSecurityPolicy.php to reflect my other server’s web address like so: protected $allowedFrame… --- ## [App Element for Nextcloud (riotchat) - CSP Refused to load the script](https://help.nextcloud.com/t/app-element-for-nextcloud-riotchat-csp-refused-to-load-the-script/194022)
**Author:** [@Mika4D](https://help.nextcloud.com/u/Mika4D)\ **Replies:** 0\ **Last updated:** [May 30, 2024, 5:19pm UTC](https://help.nextcloud.com/t/app-element-for-nextcloud-riotchat-csp-refused-to-load-the-script/194022 "2024-05-30T17:19:25Z")
:information\_source: Support installation apps update\_problems Nextcloud version (eg, 29.0.5): 29.0.1 Operating system and version (eg, Ubuntu 29.04): Debian 11 Apache or nginx version (eg, Apache 2.4.25): Nginx 1.18… --- ## [Content-Security-Policy issue](https://help.nextcloud.com/t/content-security-policy-issue/192491)
**Author:** [@axbzh](https://help.nextcloud.com/u/axbzh)\ **Replies:** 6\ **Last updated:** [May 17, 2024, 9:54pm UTC](https://help.nextcloud.com/t/content-security-policy-issue/192491 "2024-05-17T21:54:13Z")
Hi everyone, I’m building up my home lab, especially with NC and I’m facing problems with “Content-Security-Policy” in my browser. I know this topic has already been discussed several times but I haven’t found a soluti… --- ## [Nextcloud - Collabora - Traefik - no connection with https](https://help.nextcloud.com/t/nextcloud-collabora-traefik-no-connection-with-https/190511)
**Author:** [@Daniel-WW](https://help.nextcloud.com/u/Daniel-WW)\ **Replies:** 8\ **Last updated:** [May 11, 2024, 8:33pm UTC](https://help.nextcloud.com/t/nextcloud-collabora-traefik-no-connection-with-https/190511 "2024-05-11T20:33:51Z")
Support introSorry to hear you’re facing problems :slightly\_frowning\_face: help.nextcloud.com is for home/non-enterprise users. If you’re running a business, paid support can be accessed via portal.nextcloud.com where … --- ## [Nextcloud/ CODE connection Refused to frame 'https://xxxxxx. because an ancestor violates the following Content Security Policy directive: "frame-ancestors 'self'"](https://help.nextcloud.com/t/nextcloud-code-connection-refused-to-frame-https-xxxxxx-because-an-ancestor-violates-the-following-content-security-policy-directive-frame-ancestors-self/188975)
**Author:** [@nonofr911](https://help.nextcloud.com/u/nonofr911)\ **Replies:** 2\ **Last updated:** [April 30, 2024, 6:02am UTC](https://help.nextcloud.com/t/nextcloud-code-connection-refused-to-frame-https-xxxxxx-because-an-ancestor-violates-the-following-content-security-policy-directive-frame-ancestors-self/188975 "2024-04-30T06:02:36Z")
Hello everyone. I have recently had problems displaying documents with collabora CODE. My config has been working for several months without any particular difficulty. but now it doesn’t work anymore. After reading the c… --- ## [CSP configuration performed by user or host?](https://help.nextcloud.com/t/csp-configuration-performed-by-user-or-host/177969)
**Author:** [@rokejulianlockhart](https://help.nextcloud.com/u/rokejulianlockhart)\ **Replies:** 3\ **Last updated:** [January 2, 2024, 1:37pm UTC](https://help.nextcloud.com/t/csp-configuration-performed-by-user-or-host/177969 "2024-01-02T13:37:47Z")
Per Images and HTML tags not rendered in Notes section of tasks. · Issue #2274 · nextcloud/tasks · GitHub, I’m unable to view !\[title\](https://example.com/image.extension){.MD} in tasks descriptions at Login – Nextcloud.… --- ## [Stuck again on login screen - Content Security Policy violation](https://help.nextcloud.com/t/stuck-again-on-login-screen-content-security-policy-violation/131224)
**Author:** [@alexs77](https://help.nextcloud.com/u/alexs77)\ **Replies:** 3\ **Last updated:** [December 17, 2023, 11:47pm UTC](https://help.nextcloud.com/t/stuck-again-on-login-screen-content-security-policy-violation/131224 "2023-12-17T23:47:22Z")
I’m trying to use NextCloud 23.0.0 using the official Docker image. I re-installed NC on Friday and was able to successfully login until yesterday (Sunday) evening. Posting in the Installation category, as it seems that … --- ## [How to allow iFrame / Update /var/www/nextcloud/lib/public/AppFramework/Http/ContentSecurityPolicy.php](https://help.nextcloud.com/t/how-to-allow-iframe-update-var-www-nextcloud-lib-public-appframework-http-contentsecuritypolicy-php/146718)
**Author:** [@msch](https://help.nextcloud.com/u/msch)\ **Replies:** 3\ **Last updated:** [October 6, 2022, 6:56am UTC](https://help.nextcloud.com/t/how-to-allow-iframe-update-var-www-nextcloud-lib-public-appframework-http-contentsecuritypolicy-php/146718 "2022-10-06T06:56:25Z")
Hallo zusammen, ich habe eine fragen an euch, wenn ein Update kommt wird jedes mail diese Datei überschrieben (ContentSecurityPolicy.php) How to allow iFrame /var/www/nextcloud/lib/public/AppFramework/Http/ContentSecu… --- ## [CSP issues in appstore on Google Cloud Run (reverse proxy)](https://help.nextcloud.com/t/csp-issues-in-appstore-on-google-cloud-run-reverse-proxy/118298)
**Author:** [@summersab](https://help.nextcloud.com/u/summersab)\ **Replies:** 0\ **Last updated:** [June 13, 2021, 5:15am UTC](https://help.nextcloud.com/t/csp-issues-in-appstore-on-google-cloud-run-reverse-proxy/118298 "2021-06-13T05:15:43Z")
Update: looks like this has to do with broken CSP for the screenshot links in apps.json? I’ve written a quick patch to get me through, but I plan to dig a bit deeper, write something more permanent, and share it. Bottom … --- ## [CSP header problem. Plz help me implement this header!](https://help.nextcloud.com/t/csp-header-problem-plz-help-me-implement-this-header/37210)
**Author:** [@kyj4995](https://help.nextcloud.com/u/kyj4995)\ **Replies:** 0\ **Last updated:** [September 20, 2018, 2:02am UTC](https://help.nextcloud.com/t/csp-header-problem-plz-help-me-implement-this-header/37210 "2018-09-20T02:02:10Z")
I installed nextcloud under a subdirectory and configured nginx configuration files with little help from nginxconfig.io. I merged all of the settings and here’s problem. I have tried enabling Content-Security-Policy he…