Skip to content
MDView as Markdown

Apache

Apache sets response headers with mod_headers, and for a CSP you almost always want Header always set rather than the default. The difference decides whether your error pages carry a policy or not.

What Apache gives you

  • The Header directive, which can set, append, merge or remove response headers, applied after the content handler and output filters run.
  • An optional condition argument: onsuccess (the default, and can be omitted) or always. Headers in the always table are added even on error responses and persist across internal redirects such as ErrorDocument handlers.
  • Header usable in the main config, virtual hosts, directories and .htaccess, so the policy can be scoped.

Setting the header

Your URL comes from the Setup page:

Header always set Content-Security-Policy-Report-Only "default-src 'none'; form-action 'none'; frame-ancestors 'none'; report-uri https://abc123.report-uri.com/r/d/csp/reportOnly"

That is the same starting policy we recommend for the CSP Wizard, and report-only blocks nothing.

Things to watch for

  • Without always, an ErrorDocument handler or an internal redirect can return a page with no policy on it. Error pages are still pages, and they still run scripts.
  • Header set replaces; Header append and Header merge add to an existing value. If a proxy or application further up is already sending a CSP, set at the wrong layer will mask it and append will produce a policy that is the intersection of both - neither is usually what was intended. Check what leaves the origin first.
  • Apache cannot generate a per-request nonce without mod_lua or similar. Allowlist and hash-based policies work fine; nonce-based policies belong in the application.

Official documentation

Apache HTTP Server - mod_headers

Start Monitoring with Report URI

Already using us for CSP? Find your report-uri value on Setup, or view your CSP reports.

New to Report URI? Create an account and grab your report-uri value from the Setup page. Prefer a guided setup? The CSP Wizard builds a policy from your reports automatically once you're signed in.

Start your free trial