Does Cloudflare add headers?

[user14006]

So I have a website behind nginx and I wonder where the headers are coming from, for example I have this content security policy: default-src 'self';base-uri 'self';block-all-mixed-content;font-src 'self' https: data:;frame-ancestors 'self';img-src 'self' data:;object-src 'none';script-src 'self';script-src-attr 'none';style-src 'self' https: 'unsafe-inline';upgrade-insecure-requests and haven’t specified it on my nginx and also not on my web server.
Any ideas?
If Cloudflare adds headers, is there a way to deactivate it?

[fritex]

@user14006

I wonder where the headers are coming from

@user14006

content security policy

@user14006

If Cloudflare adds headers

By default, no.

@user14006

and haven’t specified it on my nginx and also not on my web server

@user14006

content security policy

@user14006

Any ideas

Your web app might add them → NodeJS or some similar maybe?

@user14006

a way to deactivate it

You can try to remove them using Transform Rules at Cloudflare, if interested.

https://developers.cloudflare.com/rules/transform/

Modifying HTTP response headers with Transform Rules

[michael]

@user14006

for example I have this content security policy

Is this a Report-Only policy? Cloudflare Page Shield adds a Report-Only CSP policy when it is enabled.

https://developers.cloudflare.com/page-shield/about/

[user14006]

@fritex

You can try to remove them using Transform Rules at Cloudflare, if interested.

Yes its node