Background:
This is logged on the back of the discussion with the ZAP team about the current behaviour of XML External Entity Attack scanner. There were two concerns raised in this discussion. I am creating seperate tickets for them as they can be addressed independent of each other. F

在nginx环境下, 网站上的图形或字体加载不了, 显示为方框. 配置问题, fontawesome图标字体库组件在服务器上显示不出来图标的问题.

先看看路径是否加载失败. .ttf 和.woff 文件, 确认路径正确

找到 nginx的配置文件 ,ps -ef | grep nginx

文件名 default_*.conf

加上

location ~* \.(eot|otf|ttf|woff|svg)$ {
        root    /home/web/waimai/; #项目路径, 必须加上, 除非你只有一个项目,默认80端口.
        add_header Access-Control-Allow-Origin *;
}

If HTTP sites (is not HTTPS ones) use the Access-Control-Allow-Origin header then the site will typically not work.
ZAP should automatically fix this header.
https://stackoverflow.com/questions/61940616/how-do-i-work-with-http-sites-using-the-hud-in-owasps-zap-proxy