在server块中直接加上，基本的一些安全防护都有了。

# frame 同源策略
add_header X-Frame-Options SAMEORIGIN;
# CSP防护
add_header  Content-Security-Policy  "default-src 'self'; script-src 'self' 'unsafe-inline';font-src 'self' data:; img-src 'self'  data: 'unsafe-inline' https:; style-src 'self' 'unsafe-inline';frame-ancestors 'self'; frame-src 'self';connect-src https:";
# 开启XSS防护
add_header X-Xss-Protection "1";
# 资源解析
add_header X-Content-Type-Options nosniff;
# HSTS防护
add_header Strict-Transport-Security "max-age=172800; includeSubDomains";
# Alert group Insecure Referrer Policy
add_header  Referrer-Policy  "origin-when-crossorigin";
add_header 'Referrer-Policy' 'origin';
add_header 'Referrer-Policy' 'unsafe-url';