server { listen 8082; root /usr/share/nginx/html; index index.html; server_name _; autoindex on; add_header Content-Security-Policy "default-src 'self'"; add_header X-Frame-Options DENY; location = /test1 { rewrite ^(.*)$ /xss.html break; } location = /test2 { add_header X-Content-Type-Options nosniff; rewrite ^(.*)$ /xss.html break; } }