Hi sudir,

The "Unsupported Browser" error can occur when the CSP configured in Nginx is too restrictive for the Mendix client.

I would suggest checking the browser's Developer Tools → Console first. It will usually show which CSP directive is blocking the Mendix resources.

As a starting point, you can use a CSP similar to the following:

add_header Content-Security-Policy "default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval'; connect-src 'self'; font-src 'self' https://fonts.gstatic.com data:; img-src 'self' data:; style-src 'self' 'unsafe-inline' https://fonts.googleapis.com; base-uri 'self'; form-action 'self'; object-src 'none'; frame-ancestors 'self';" always;

Also, when using Nginx as a reverse proxy, make sure the forwarded HTTPS headers are configured correctly:

proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;

After making the changes, run:

nginx -t

and reload Nginx:

systemctl reload nginx

Then clear the browser cache and test the application again.

If the issue still occurs, check the browser Console for the exact CSP violation. The blocked resource/directive in the error message will help identify what needs to be added to the CSP.

It is better to start with the recommended Mendix CSP configuration and then adjust it based on the actual CSP violations rather than allowing everything.

Hi Sivakuamr,

Thanks for the quick reply.

You have written "It is better to start with the recommended Mendix CSP configuration". Can you list it out.

Regards

Sudhir

Hi Sudhir,

The issue is most likely caused by the Content-Security-Policy header being too restrictive for the Mendix client.

I would first check the browser's Developer Tools → Console. If CSP is the cause, you should see messages such as:

Refused to load the script ...
because it violates the following Content Security Policy directive...

or similar messages for connect-src, style-src, font-src, img-src, etc.

Mendix provides a baseline CSP that can be used as a starting point:

default-src 'self';
script-src 'self' 'unsafe-inline' 'unsafe-eval';
connect-src 'self';
font-src 'self' https://fonts.gstatic.com data:;
img-src 'self' data:;
style-src 'self' 'unsafe-inline' https://fonts.googleapis.com;
base-uri 'self';
form-action 'self';
frame-ancestors 'self';
object-src 'none';

I would not copy a random CSP from Google and apply it directly to NGINX. The required directives depend on the Mendix application, widgets, external APIs, fonts, integrations, etc.

For example, if the application uses an external API, the corresponding domain may need to be allowed under connect-src. If external fonts are used, they need to be allowed under font-src, and so on.

Also, if the intention is simply to put NGINX in front of the Mendix application, the reverse proxy itself does not require CSP. NGINX should mainly forward the request to the Mendix runtime, for example:

location / {
    proxy_pass http://mendix-runtime:8080;

    proxy_set_header Host $host;
    proxy_set_header X-Real-IP $remote_addr;
    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
    proxy_set_header X-Forwarded-Proto https;
}

Mendix provides NGINX reverse-proxy examples, but the exact configuration depends on your deployment architecture.

If the Mendix application is hosted under a subpath, there are additional headers that are important, especially:

proxy_set_header X-Forwarded-Proto "https";
proxy_set_header X-Forwarded-Host $host;
proxy_set_header X-Forwarded-Prefix /my/sub/path;

and the Mendix ApplicationRootUrl needs to match the public URL.

So I would troubleshoot this in this order:

1. Put NGINX in front of the Mendix runtime without the custom CSP header and confirm that the application works.
2. Add the CSP header.
3. Open browser Developer Tools → Console.
4. Identify exactly which resource is being blocked.
5. Add only the required source to the appropriate CSP directive.
6. Test again.

One more point: if you are trying to implement a strict CSP such as default-src 'self', Mendix documents that some pluggable widgets may not yet be fully CSP compliant. Such widgets can cause CSP errors or broken functionality.

So I would not try to fix the Unsupported Browser message itself. First check the CSP violation in the browser console; that will tell you which directive/resource is actually causing the Mendix client to fail.

Hope this helps.

Hi,

I am attaching the screen shot where auditor is saying to remove ALLOW portion, and highlighted portion. Kindly help me.

Hi,

I am attaching the screen shot where auditor is saying to remove ALLOW portion, and highlighted portion. Kindly help me.

Hi All,

If you notice the above screen there is a duplicate entry "Strict-Transport-Secutiy". So Question is how to set right the nginx setings.

Regards

Sudhir