All geek questions in one place

Invalid Content-Security-Policy Command

I added the following lines to the .htacces file:

Content-Security-Policy: default-src 'self' X-Content-Security-Policy: default-src 'self' X-WebKit-CSP: default-src 'self'

But I always had the following error:

 Invalid command 'Content-Security-Policy:', perhaps misspelled or defined by a module not included in the server configuration

I do not understand. Which Apache module do I need to activate? What is wrong with these lines?

thanks david

+4
source share
2 answers

I am not an apache expert, but the content security policy is the response header. http://httpd.apache.org/docs/2.2/mod/mod_headers.html

+1
source

Add these lines to the httpd.conf configuration files, either inside your virtualhost sections or inside your .htaccess files:

 Header unset Content-Security-Policy Header add Content-Security-Policy "default-src 'self'" Header unset X-Content-Security-Policy Header add X-Content-Security-Policy "default-src 'self'" Header unset X-WebKit-CSP Header add X-WebKit-CSP "default-src 'self'"

You may also be interested in adding these headers:

 Header set X-Content-Type-Options "nosniff" Header set X-XSS-Protection "1; mode=block" Header set X-Frame-Options "DENY" Header set Strict-Transport-Security "max-age=631138519; includeSubDomains"

You need to enable (LoadModule) mod_headers if it is not already enabled and then restart apache.

+8
source

Source: https://habr.com/ru/post/1479243/

More articles:


All Articles