Stack Exchange Network

Stack Exchange network consists of 175 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [content-security-policy]

The tag has no usage guidance.

2
votes
0answers
708 views

Refused to frame '' because it violates the following Content Security Policy directive: “frame-src *”

I have found many solutions to various situations with "refused to xyz" due to Content-Security-Policy Settings. However I can't seem to find what might be wrong if '' gets refused. The literal ...
1
vote
1answer
12 views

How do allow fontawesome as a style-src in my Content-Security-Policy?

I'm trying to set my Content-Security-Policy header in .htaccess. I've already tried a variation of the answer to this post but it doesnt work. All my fontawesome icons are broken. Header always set ...
0
votes
2answers
39 views

Prevent Unjoined-to-domain computers from connecting to my network

How to prevent any computer that is not joined to the domain from requesting any service from my network? Considering that the computer is on another network.
0
votes
0answers
24 views

Apache: bypass global CSP configuration with .htaccess

I recently implemented some strong Content Security Policies on my Apache server (v.2.4.25). Works like a charm. Here is what I have in the apache.conf <IfModule mod_headers.c> Header set ...
0
votes
0answers
30 views

Set an header if another header is missing, in a apache vhost

I know that I can add a header if its missing, using the setifempty like: Header always setifempty Content-Security-Policy-Report-Only "foobar" But how do I set a header only when another header is ...
0
votes
0answers
70 views

Content Security Policy: self domains and subdomains (nginx)

We host a bunch of websites, and at the moment our Content-Security-Policy header has a number of directives of this kind: add_header Content-Security-Policy "default-src 'self' ...
0
votes
0answers
264 views

Apache2 Loadbalancer with sticky session only sticky for GET, not POST

I have set up Apache 2.4.6 on Centos with mod_proxy and mod_headers like described in https://wiki.apache.org/httpd/LoadBalanceWithoutStickyCookie My goal is to have sticky sessions even if the ...
0
votes
0answers
135 views

which method is best for CSP nonce in Nginx?

I want to create server-side CSP nonce for my site my web server is Nginx I've written two methods for those A) using a directive in Nginx with set-misc-nginx-module set_secure_random_alphanum $...
0
votes
1answer
149 views

Content-Security-Policy for Exchange 2016

I would like to add Content-Security-Policy headers for Exchange 2016 for /owa and /ecp. Being well aware that a "too restrictive" Content-Security-Policy header can break both /owa and /ecp, is ...
0
votes
0answers
27 views

Backup and deployment of GPO from one server to another

Hi I am using LGPO to backup the policy and deploy it to another computer with the same administrator name. So I tried using LGPO /b pathname. Successfully backedup. Then I went to the other computer ...
0
votes
0answers
525 views

Content-Security-Policy issue on Apache server

Why does adding the following to the .htaccess file of my secure website cause an Error 500 (misconfiguration)? Header set Content-Security-Policy: default-src https:; form-action https:; connect-...
0
votes
1answer
716 views

How to inject random CSP nonce in APACHE?

I want to add the following CSP directive in APACHE because I want it to be applied on every page. <IfModule mod_headers.c> <FilesMatch "\.(htm|html|php)$"> Content-Security-...
0
votes
2answers
2k views

How to determine CSP for Wordpress

I'm trying to implement Content-Security-Policy headers for Wordpress but am having trouble identifying all the URL's it needs access to. Specifically, I have tried adding the header: Header always ...
0
votes
1answer
222 views

CSP response header causes firefox to abort loading of website

only in Firefox (recent and legacy) a website of mine is answered with a status code 200 but Firefox simply aborts without any error message. The server logs also show no issue. By going through the ...
0
votes
1answer
173 views

Can CSP reports be configured to exclude known blacklisted ressources?

When i use a Content-Security-Policy knowing that it will (and should) block some elements, is there a way to get reports for all violations except these? I get for example hits from a script that is ...