I'm using the following PHP script to test CSP policy,

   header("Content-Security-Policy: default-src https:; report-uri /report.php");
   header("Content-Security-Policy: default-src 'self'");

        <script src="http://google/abc.js"></script>

The CSP policy works,

enter image description here

But the report-uri part didn't. The reporting request was never sent and no relevant entry in nginx access logs

Any ideas?

  • Tried a fully qualified domain and path?
    Nov 11 '17 at 16:15
  • @ISMSDEV Tried both IP address and fqdn, but I only edited /etc/hosts to achieve it
    – daisy
    Nov 11 '17 at 16:32
  • 2
    You tried with only the one header being set? Your second one doesn’t have the report uri. Take that line out.
    Nov 11 '17 at 16:54

From the Content-Security-Policy standard:

A server SHOULD NOT send more than one HTTP response header field named "Content-Security-Policy" with a given resource representation.

But, you are using multiple Content-Security-Policy headers. The behavior is not defined for this case. But it looks like that the browsers in this case only use the latest header. This means your first header which specifies a report-uri gets ignored and only the second header use, which does not specify a report-uri.

  • 1
    Yes that looks like the problem. Missed that initially
    Nov 11 '17 at 16:58

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.