Information Security Stack Exchange is a question and answer site for information security professionals. It only takes a minute to sign up.
Sign up to join this community
I'm using the following PHP script to test CSP policy,
<?php
header("Content-Security-Policy: default-src https:; report-uri /report.php");
header("Content-Security-Policy: default-src 'self'");
?>
<html>
<body>
<script src="http://google/abc.js"></script>
</body>
</html>
The CSP policy works,
But the report-uri part didn't. The reporting request was never sent and no relevant entry in nginx access logs
Any ideas?
From the Content-Security-Policy standard:
A server SHOULD NOT send more than one HTTP response header field named "Content-Security-Policy" with a given resource representation.
But, you are using multiple Content-Security-Policy headers. The behavior is not defined for this case. But it looks like that the browsers in this case only use the latest header. This means your first header which specifies a report-uri gets ignored and only the second header use, which does not specify a report-uri.
