Nginx的跨域Content Security Policy通

HTTPS 是 HTTP over Secure Socket Layer，以安全为目标的 HTTP 通道，所以在 HTTPS 承载的页面上不允许出现 http 请求，一旦出现就是提示或报错：

Mixed Content: The page at ‘https://www.taobao.com/‘ was loaded over HTTPS, but requested an insecure image ‘http://g.alicdn.com/s.gif’. This content should also be served over HTTPS.

HTTPS改造之后，我们可以在很多页面中看到如下警报：

upgrade-insecure-requests CSP 指令的作用就是让浏览器自动升级请求，防止访问者访问不安全的内容。
该指令用于让浏览器自动升级请求从http到https,用于大量包含http资源的http网页直接升级到https而不会报错.简洁的来讲,就相当于在http和https之间起的一个过渡作用.

html强制让http的访问Https

<meta http-equiv="Content-Security-Policy" content="upgrade-insecure-requests"/>

php强制让http的访问Https

header("Content-Security-Policy: upgrade-insecure-requests");

nginx 强制让http的访问Https

server
{
    #HTTP_TO_HTTPS_END
    ssl_certificate    /etc/letsencrypt/live/yogayx.com/fullchain.pem;
    ssl_certificate_key    /etc/letsencrypt/live/yogayx.com/privkey.pem;
    ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
    ssl_ciphers ECDHE-RSA-AES128-GCM-SHA256:HIGH:!aNULL:!MD5:!RC4:!DHE;
    ssl_prefer_server_ciphers on;
    ssl_session_cache shared:SSL:10m;
    ssl_session_timeout 10m;
    
    add_header Content-Security-Policy "upgrade-insecure-requests;connect-src *";

    error_page 497  https://$host$request_uri;
}

在经过反复测试后

add_header Content-Security-Policy "upgrade-insecure-requests;connect-src *";

解决了全部问题，即消除全部警告，同时兼容了各种协议资源。