Stack Exchange Network

Stack Exchange network consists of 175 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [content-security-policy]

The tag has no usage guidance.

0
votes
2answers
2k views

How to determine CSP for Wordpress

I'm trying to implement Content-Security-Policy headers for Wordpress but am having trouble identifying all the URL's it needs access to. Specifically, I have tried adding the header: Header always ...
0
votes
1answer
149 views

Content-Security-Policy for Exchange 2016

I would like to add Content-Security-Policy headers for Exchange 2016 for /owa and /ecp. Being well aware that a "too restrictive" Content-Security-Policy header can break both /owa and /ecp, is ...
0
votes
1answer
716 views

How to inject random CSP nonce in APACHE?

I want to add the following CSP directive in APACHE because I want it to be applied on every page. <IfModule mod_headers.c> <FilesMatch "\.(htm|html|php)$"> Content-Security-...
0
votes
1answer
222 views

CSP response header causes firefox to abort loading of website

only in Firefox (recent and legacy) a website of mine is answered with a status code 200 but Firefox simply aborts without any error message. The server logs also show no issue. By going through the ...
0
votes
1answer
173 views

Can CSP reports be configured to exclude known blacklisted ressources?

When i use a Content-Security-Policy knowing that it will (and should) block some elements, is there a way to get reports for all violations except these? I get for example hits from a script that is ...
2
votes
0answers
709 views

Refused to frame '' because it violates the following Content Security Policy directive: “frame-src *”

I have found many solutions to various situations with "refused to xyz" due to Content-Security-Policy Settings. However I can't seem to find what might be wrong if '' gets refused. The literal ...
0
votes
0answers
24 views

Apache: bypass global CSP configuration with .htaccess

I recently implemented some strong Content Security Policies on my Apache server (v.2.4.25). Works like a charm. Here is what I have in the apache.conf <IfModule mod_headers.c> Header set ...
0
votes
0answers
30 views

Set an header if another header is missing, in a apache vhost

I know that I can add a header if its missing, using the setifempty like: Header always setifempty Content-Security-Policy-Report-Only "foobar" But how do I set a header only when another header is ...
0
votes
0answers
70 views

Content Security Policy: self domains and subdomains (nginx)

We host a bunch of websites, and at the moment our Content-Security-Policy header has a number of directives of this kind: add_header Content-Security-Policy "default-src 'self' ...
0
votes
0answers
265 views

Apache2 Loadbalancer with sticky session only sticky for GET, not POST

I have set up Apache 2.4.6 on Centos with mod_proxy and mod_headers like described in https://wiki.apache.org/httpd/LoadBalanceWithoutStickyCookie My goal is to have sticky sessions even if the ...
0
votes
0answers
135 views

which method is best for CSP nonce in Nginx?

I want to create server-side CSP nonce for my site my web server is Nginx I've written two methods for those A) using a directive in Nginx with set-misc-nginx-module set_secure_random_alphanum $...
0
votes
0answers
27 views

Backup and deployment of GPO from one server to another

Hi I am using LGPO to backup the policy and deploy it to another computer with the same administrator name. So I tried using LGPO /b pathname. Successfully backedup. Then I went to the other computer ...
0
votes
0answers
525 views

Content-Security-Policy issue on Apache server

Why does adding the following to the .htaccess file of my secure website cause an Error 500 (misconfiguration)? Header set Content-Security-Policy: default-src https:; form-action https:; connect-...