0

I'm using the following PHP script to test CSP policy,

<?php
   header("Content-Security-Policy: default-src https:; report-uri /report.php");
   header("Content-Security-Policy: default-src 'self'");
?>

<html>
   <body>
        <script src="http://google/abc.js"></script>
   </body>
</html>

The CSP policy works,

enter image description here

But the report-uri part didn't. The reporting request was never sent and no relevant entry in nginx access logs

Any ideas?

Improve this question
  • Tried a fully qualified domain and path? – ISMSDEV Nov 11 '17 at 16:15
  • @ISMSDEV Tried both IP address and fqdn, but I only edited /etc/hosts to achieve it – daisy Nov 11 '17 at 16:32
  • 2
    You tried with only the one header being set? Your second one doesn’t have the report uri. Take that line out. – ISMSDEV Nov 11 '17 at 16:54
3

From the Content-Security-Policy standard:

A server SHOULD NOT send more than one HTTP response header field named "Content-Security-Policy" with a given resource representation.

But, you are using multiple Content-Security-Policy headers. The behavior is not defined for this case. But it looks like that the browsers in this case only use the latest header. This means your first header which specifies a report-uri gets ignored and only the second header use, which does not specify a report-uri.

Improve this answer
  • 1
    Yes that looks like the problem. Missed that initially – ISMSDEV Nov 11 '17 at 16:58

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.