缺少“X-XSS-Protection”,“X-Content-Type-Options”, “Content-Security-Policy” “X-Frame-Options”头

用AppScan扫描网站，高危问题：缺少“X-XSS-Protection”,“X-Content-Type-Options”, “Content-Security-Policy”头解决方式
Web服务器为iis的解决方案：

<?xml version="1.0" encoding="UTF-8"?>
<configuration>
    <system.webServer>
        <defaultDocument>
            <files>
                <add value="index.asp" />
            </files>
        </defaultDocument>
        <httpProtocol>
           <customHeaders>
                <add name="X-Frame-Options" value="SAMEORIGIN" />
                <add name="X-Content-Type-Options" value="nosniff" />
                <add name="X-XSS-Protection" value="1; mode=block" />
                <add name="Referrer-Policy" value="no-referrer-when-downgrade" />
                <add name="Content-Security-Policy" value="default-src *;img-src *; style-src 'self' 'unsafe-inline'; script-src * 'self' 'unsafe-inline' 'unsafe-eval'" />
                <add name="Strict-Transport-Security" value="max-age=63072000; includeSubdomains; preload" />
            </customHeaders>
        </httpProtocol>
    </system.webServer>
</configuration>

web服务器为Nginx的解决方案：
将下面内容添加到nginx.conf 文件http 结构下：

# security headers
add_header X-Frame-Options "SAMEORIGIN" always;
add_header X-XSS-Protection "1; mode=block" always;
add_header X-Content-Type-Options "nosniff" always;
add_header Referrer-Policy "no-referrer-when-downgrade" always;
add_header Content-Security-Policy "default-src 'self' http: https://* data: blob: 'unsafe-eval' 'unsafe-inline';child-src 'none' " always;
add_header Strict-Transport-Security "max-age=31536000; includeSubDomains; preload" always;