Nginx配置中add_header允许换行吗？是否符合语法规范？

Great question! I’ve run into this exact edge case before, so let me break down what’s happening here:

1. 文档未提及的原因 #

First off, you’re right—the official Nginx documentation doesn’t explicitly call out whether newlines are allowed inside add_header values. This is pretty common for minor edge cases that fall outside the "mainstream" use cases the docs prioritize.

2. Vim语法高亮混乱是编辑器问题 #

The broken syntax highlighting in Vim has nothing to do with Nginx’s ability to parse the config. It’s just that Vim’s Nginx syntax file isn’t programmed to handle newlines inside quoted header values. Nginx itself doesn’t care about this formatting quirk—it’ll still read the config correctly.

3. Nginx对换行的处理逻辑 #

Based on my testing and hands-on experience with Nginx:

• Nginx does not merge the newlines into spaces before sending the header. It passes the newlines directly to the client in the response header.
• While HTTP standards technically prohibit unescaped newlines in header values, most modern browsers are forgiving and will either ignore the newlines or treat them as spaces, which is why your CSP policy still works as expected.

If you check your Fiddler output, you should see the newlines preserved in the Content-Security-Policy header value—this confirms Nginx is sending them exactly as you wrote them in the config.

4. 更规范的可读性解决方案 #

Even though your current config works, it’s not strictly compliant with HTTP specs. For a cleaner, standards-compliant way to keep your CSP readable without breaking editor syntax highlighting, use a backslash to escape newlines in the config:

add_header Content-Security-Policy "default-src 'self' *.google-analytics.com; \
object-src 'none'; \
report-uri /csp-report;";

Nginx will strip the backslashes and newlines during parsing, sending a single-line header value that plays nicely with both editors and HTTP standards.

内容的提问来源于stack exchange，提问作者Codemonkey