I want to add the following CSP directive in APACHE because I want it to be applied on every page.

<IfModule mod_headers.c>
    <FilesMatch "\.(htm|html|php)$">
        Content-Security-Policy: script-src 'strict-dynamic' 'nonce-{random}' 'unsafe-inline' ' https:;

I'd like to generate the {random} value directly in APACHE as well (if possible).

Is it possible to generate and insert it directly in the APACHE CSP directive? Or is this a bad idea, should I be generate and insert at the application layer instead (PHP)?

NOTE: I did find this which Generate a nonce with Apache 2.4 (for a Content Security Policy header) looked promising but I'm not sure if the $_SERVER[UNIQUE_ID] is actually a random enough value.


The nonce you set up in your CSP header has to be the same you use with your script tag. That's why it is typically set at the application level, where the save value can be used in the HTTP header and in your HTML. If you set it at the Apache level, how do you use it in your application?

| improve this answer | |
  • 1
    As an example, you could do this is Apache: <IfModule mod_headers.c> <FilesMatch "\.(htm|html|php)$"> Content-Security-Policy: script-src 'strict-dynamic' 'nonce-%{UNIQUE_ID}e' 'unsafe-inline' ' https:; </FilesMatch> </IfModule> And then use the variable $_SERVER['UNIQUE_ID'] in your PHP code. – user3526609 Aug 28 '18 at 1:47

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.