Skip to content
MDView as Markdown

IIS

IIS adds response headers through the <customHeaders> element of <httpProtocol>, either by editing web.config directly or through the HTTP Response Headers pane in IIS Manager. Custom response headers are returned on every response, which is what you want for a CSP.

What IIS gives you

  • <customHeaders> under <system.webServer><httpProtocol>, configurable per site, application or directory.
  • The same setting exposed through IIS Manager: select the site, open HTTP Response Headers, then Add.
  • Configuration also possible via AppCmd and the management APIs, so it can be scripted into a deployment.

Setting the header

Your URL comes from the Setup page:

<configuration>
  <system.webServer>
    <httpProtocol>
      <customHeaders>
        <add name="Content-Security-Policy-Report-Only"
             value="default-src 'none'; form-action 'none'; frame-ancestors 'none'; report-uri https://abc123.report-uri.com/r/d/csp/reportOnly" />
      </customHeaders>
    </httpProtocol>
  </system.webServer>
</configuration>

That is the same starting policy we recommend for the CSP Wizard, and report-only blocks nothing.

Things to watch for

  • Settings are inherited down the tree, so a web.config in a subdirectory or a nested application can override the policy you set at the site level. If a section of the site is missing its header, look for a nested config before anything else.
  • <customHeaders> is a static value - IIS cannot generate a per-request nonce here. Nonce-based policies need the application, or an outbound URL Rewrite rule.
  • If the application also sets the header in code, you end up with two policies and the browser enforces both. Pick one layer and keep it there.

Official documentation

Microsoft - Custom Headers <customHeaders>

Start Monitoring with Report URI

Already using us for CSP? Find your report-uri value on Setup, or view your CSP reports.

New to Report URI? Create an account and grab your report-uri value from the Setup page. Prefer a guided setup? The CSP Wizard builds a policy from your reports automatically once you're signed in.

Start your free trial