Questions tagged [content-security-policy]
The content-security-policy tag has no usage guidance.
14
questions with no upvoted or accepted answers
5
votes
0
answers
1k
views
Client-side caching when using CSP with nonces in nginx - how do you use weak caching validators/etags?
I'm using nginx's expires directive; its etag directive as well as the Last-Modified header (if I understand correctly) are on by default.
In order to allow specific inline JavaScripts when using ...
- 151
3
votes
0
answers
8k
views
How to configure Content-Security-Policy for Nginx and Drupal 8?
I have a Nginx server with Ubuntu 18.04 and a Drupal 8 site.
I have read on several articles that should not use 'unsafe-eval', 'unsafe-inline'
I added headers for security but the pages of the site ...
- 31
2
votes
0
answers
3k
views
Implementing Content-Security-Policy on Apache 2.2
On Apache 2.2 I'm about to set up Content-Security-Policy to allow browsers coming from one particular domain to load data into iframes from a certain virtual host.
$ httpd -S
VirtualHost ...
- 21
2
votes
0
answers
293
views
Images on wordpress arent loading
I've recently installed a clean wordpress installation on my Ubuntu 18.04 LTS Server using nginx. Now i'm running into an error, when I've uploaded my images, I cant see them on the page.
Thats what ...
- 21
1
vote
0
answers
333
views
Editing Content Security Policy in IIS to allow a CDN script to be loaded
I am currently trying to load an external plugin into an application that is deployed on IIS.
I am getting this error:
Refused to load the script 'https://cdn.babylonjs.com/loaders/babylon....
- 11
1
vote
0
answers
272
views
Nginx, webP, and a strict content security policy (SCP) on a LEMP Server
I am attempting to create a strong and secure content-security-policy in nginx, running a wordpress based LEMP Server. I believe I am using the ngx_pagespeed.so module, and have implemented FastCGI on ...
- 93
1
vote
0
answers
3k
views
Why doesn't nginx proxy_hide_headers directive work in this case?
I have an nginx server block like this, and I am trying to use the proxy_hide_header directive to hide the Content-Security-Policy response header from the proxied server because I am not running an ...
- 253
1
vote
1
answer
768
views
Can CSP reports be configured to exclude known blacklisted ressources?
When i use a Content-Security-Policy knowing that it will (and should) block some elements, is there a way to get reports for all violations except these?
I get for example hits from a script that is ...
- 1,713
0
votes
0
answers
22
views
Seeking Guidance on Excluding Directory from General CSP
Good Day. I have been working on rebuilding a CSP for a client that has insisted on a particularly restrictive configuration. :data and unsafe-inline must be ruled out and my developer advises me that ...
0
votes
0
answers
1k
views
configuring content-security-policy for apache virtual hosts
I have Apache 2.4 with these sites configured in the httpd-vhosts.conf file:
<VirtualHost *:80 *:8080 *:8084>
DocumentRoot "c:\apache_php\sites\public"
ServerName www.mydomain....
- 133
0
votes
0
answers
1k
views
Setting "Content-Security-Policy default-src https:" breaks site
I need to set the Content-Security-Policy header to allow loading scripts from any HTTPS source. When I add the following line to my nginx configuration, the look and feel of the site breaks. What am ...
- 111
0
votes
0
answers
442
views
Content-Security-Policy issues
I'm running NGINX as a reverse proxy and I4ve set the Content-Security-Policy header and I'm running into problems with some directives.
I get the following errors in the console:
Unrecognized Content-...
- 101
0
votes
2
answers
254
views
Setting SElinux Labels for a magento site on Centos 7
I was hoping someone could kindly help myself. I have a Magento site running on a Centos 7.6 server.
Now, the site is not correctly loading and looking in the messages.log I see numerous entries ...
- 113
0
votes
1
answer
404
views
CSP response header causes firefox to abort loading of website
only in Firefox (recent and legacy) a website of mine is answered with a status code 200 but Firefox simply aborts without any error message. The server logs also show no issue. By going through the ...
- 1