Questions tagged [content-security-policy]

The tag has no usage guidance.

Filter by
Sorted by
Tagged with
0
votes
0answers
24 views

Why doesn't nginx proxy_hide_headers directive work in this case?

I have an nginx server block like this, and I am trying to use the proxy_hide_header directive to hide the Content-Security-Policy response header from the proxied server because I am not running an ...
0
votes
0answers
12 views

On what server is the 'frame-ancestors' Content Security Policy managed?

I'm just trying to get clarification on the proper use of this. Assuming I have a website on server 'A' that intends to serve an i-frame of a page hosted by server 'B', but the request is being ...
1
vote
0answers
38 views

Google Cloud Services Content Security Policy Issues

I have a static web site hosted in a bucket that I serve up via the Google Platform. This site has been running with no problems for about 6 months but over the last month I have had intermittent ...
1
vote
0answers
42 views

Images on wordpress arent loading

I've recently installed a clean wordpress installation on my Ubuntu 18.04 LTS Server using nginx. Now i'm running into an error, when I've uploaded my images, I cant see them on the page. Thats what ...
2
votes
0answers
449 views

How to configure Content-Security-Policy for Nginx and Drupal 8?

I have a Nginx server with Ubuntu 18.04 and a Drupal 8 site. I have read on several articles that should not use 'unsafe-eval', 'unsafe-inline' I added headers for security but the pages of the site ...
0
votes
2answers
110 views

Setting SElinux Labels for a magento site on Centos 7

I was hoping someone could kindly help myself. I have a Magento site running on a Centos 7.6 server. Now, the site is not correctly loading and looking in the messages.log I see numerous entries ...
1
vote
1answer
692 views

How do allow fontawesome as a style-src in my Content-Security-Policy?

I'm trying to set my Content-Security-Policy header in .htaccess. I've already tried a variation of the answer to this post but it doesnt work. All my fontawesome icons are broken. Header always set ...
0
votes
0answers
910 views

Apache2 Loadbalancer with sticky session only sticky for GET, not POST

I have set up Apache 2.4.6 on Centos with mod_proxy and mod_headers like described in https://wiki.apache.org/httpd/LoadBalanceWithoutStickyCookie My goal is to have sticky sessions even if the ...
7
votes
1answer
5k views

Refused to frame '' because it violates the following Content Security Policy directive: “frame-src *”

I have found many solutions to various situations with "refused to xyz" due to Content-Security-Policy Settings. However I can't seem to find what might be wrong if '' gets refused. The literal ...
0
votes
2answers
566 views

Content-Security-Policy for Exchange 2016

I would like to add Content-Security-Policy headers for Exchange 2016 for /owa and /ecp. Being well aware that a "too restrictive" Content-Security-Policy header can break both /owa and /ecp, is ...
0
votes
2answers
90 views

Prevent Unjoined-to-domain computers from connecting to my network

How to prevent any computer that is not joined to the domain from requesting any service from my network? Considering that the computer is on another network.
1
vote
1answer
1k views

How to inject random CSP nonce in APACHE?

I want to add the following CSP directive in APACHE because I want it to be applied on every page. <IfModule mod_headers.c> <FilesMatch "\.(htm|html|php)$"> Content-Security-...
0
votes
2answers
3k views

How to determine CSP for Wordpress

I'm trying to implement Content-Security-Policy headers for Wordpress but am having trouble identifying all the URL's it needs access to. Specifically, I have tried adding the header: Header always ...
0
votes
1answer
266 views

CSP response header causes firefox to abort loading of website

only in Firefox (recent and legacy) a website of mine is answered with a status code 200 but Firefox simply aborts without any error message. The server logs also show no issue. By going through the ...
0
votes
1answer
373 views

Can CSP reports be configured to exclude known blacklisted ressources?

When i use a Content-Security-Policy knowing that it will (and should) block some elements, is there a way to get reports for all violations except these? I get for example hits from a script that is ...