IIS¶

IIS adds response headers through the <customHeaders> element of <httpProtocol>, either by editing web.config directly or through the HTTP Response Headers pane in IIS Manager. Custom response headers are returned on every response, which is what you want for a CSP.

What IIS gives you¶

<customHeaders> under <system.webServer><httpProtocol>, configurable per site, application or directory.
The same setting exposed through IIS Manager: select the site, open HTTP Response Headers, then Add.
Configuration also possible via AppCmd and the management APIs, so it can be scripted into a deployment.

Setting the header¶

Your URLs come from the Setup page:

<configuration>
  <system.webServer>
    <httpProtocol>
      <customHeaders>
        <add name="Content-Security-Policy-Report-Only"
             value="default-src 'none'; script-src 'report-sha256'; form-action 'none'; frame-ancestors 'none'; report-uri https://abc123.report-uri.com/r/d/csp/reportOnly; report-to default" />
        <add name="Reporting-Endpoints"
             value="default=&quot;https://abc123.report-uri.com/a/d/g&quot;" />
        <add name="Report-To"
             value="{&quot;group&quot;:&quot;default&quot;,&quot;max_age&quot;:31536000,&quot;endpoints&quot;:[{&quot;url&quot;:&quot;https://abc123.report-uri.com/a/d/g&quot;}],&quot;include_subdomains&quot;:true}" />
      </customHeaders>
    </httpProtocol>
  </system.webServer>
</configuration>

The Reporting-Endpoints and Report-To headers tell the browser where report-to default sends reports, including the CSP Integrity reports that 'report-sha256' turns on.

That is the same starting policy we recommend for the CSP Wizard, and report-only blocks nothing.

Things to watch for¶

Settings are inherited down the tree, so a web.config in a subdirectory or a nested application can override the policy you set at the site level. If a section of the site is missing its header, look for a nested config before anything else.
<customHeaders> is a static value - IIS cannot generate a per-request nonce here. Nonce-based policies need the application, or an outbound URL Rewrite rule.
If the application also sets the header in code, you end up with two policies and the browser enforces both. Pick one layer and keep it there.

Official documentation¶

Microsoft - Custom Headers <customHeaders>

Start Monitoring with Report URI¶

Already using us for CSP? Find your CSP reporting directives on Setup, or view your CSP reports.

New to Report URI? Create an account and grab your CSP reporting directives from the Setup page. Prefer a guided setup? The CSP Wizard builds a policy from your reports automatically once you're signed in.

Start your free trial