Skip to content
MDView as Markdown

Apache

Apache sets response headers with mod_headers, and for a CSP you almost always want Header always set rather than the default. The difference decides whether your error pages carry a policy or not.

What Apache gives you

  • The Header directive, which can set, append, merge or remove response headers, applied after the content handler and output filters run.
  • An optional condition argument: onsuccess (the default, and can be omitted) or always. Headers in the always table are added even on error responses and persist across internal redirects such as ErrorDocument handlers.
  • Header usable in the main config, virtual hosts, directories and .htaccess, so the policy can be scoped.

Setting the header

Your URLs come from the Setup page:

Header always set Content-Security-Policy-Report-Only "default-src 'none'; script-src 'report-sha256'; form-action 'none'; frame-ancestors 'none'; report-uri https://abc123.report-uri.com/r/d/csp/reportOnly; report-to default"
Header always set Reporting-Endpoints 'default="https://abc123.report-uri.com/a/d/g"'
Header always set Report-To "{\"group\":\"default\",\"max_age\":31536000,\"endpoints\":[{\"url\":\"https://abc123.report-uri.com/a/d/g\"}],\"include_subdomains\":true}"

The Reporting-Endpoints and Report-To headers tell the browser where report-to default sends reports, including the CSP Integrity reports that 'report-sha256' turns on.

That is the same starting policy we recommend for the CSP Wizard, and report-only blocks nothing.

Things to watch for

  • Without always, an ErrorDocument handler or an internal redirect can return a page with no policy on it. Error pages are still pages, and they still run scripts.
  • Header set replaces; Header append and Header merge add to an existing value. If a proxy or application further up is already sending a CSP, set at the wrong layer will mask it and append will produce a policy that is the intersection of both - neither is usually what was intended. Check what leaves the origin first.
  • Apache cannot generate a per-request nonce without mod_lua or similar. Allowlist and hash-based policies work fine; nonce-based policies belong in the application.

Official documentation

Apache HTTP Server - mod_headers

Start Monitoring with Report URI

Already using us for CSP? Find your CSP reporting directives on Setup, or view your CSP reports.

New to Report URI? Create an account and grab your CSP reporting directives from the Setup page. Prefer a guided setup? The CSP Wizard builds a policy from your reports automatically once you're signed in.

Start your free trial