Apache – Fixing .htaccess Content-Security-Policy Header 500 Error

apache-2.4Apache2

I am trying to add 2 headers to the .htaccess file but when the site is reloaded it gives a 500 internal server error

First header is:

Header set Content-Security-Policy: default-src https:

According to this website, this should allow any assets to load over https from any origin.

Second header is:

Permissions-Policy: geolocation=(self "https://example.com"), microphone=()

Obviously changing example.com to the proper domain, but the same website says this should work but also causes internal server error.

Best Answer

Header set Content-Security-Policy: default-src https:

Syntax is wrong.

Header set Content-Security-Policy "default-src https:"

Is correct syntax.

In addition you should verify that mod_headers is enabled.

Related Solutions

Security – Is setting a Content Security Policy incompatible with Joomla’s admin page

After looking at the source code, it appears that the error message is erroneous and misleading. What appears to be causing your problem is that there are several inline JavaScript elements. In other words, the policy you are defining allows content like this:

<script src="/media/myjsfile.js"></script>

But not like this:

<script>function myJsFunction()</script>

In order to allow inline JavaScript (not recommended as this defeats the purpose of using CSP), you need to modify your policy to something like:

script-src 'self' 'unsafe-inline'

Alternatively, you can refactor the code to not use inline JS, or take advantage of the nonce attribute. Keep in mind that support for the nonce attribute is not currently present in all browsers (it is part of the latest spec for Content Security Policy). To my knowledge, it is currently only supported in Chrome.

Apache .htaccess – SSLRequireSSL Produces HTTP 500 Internal Server Error

This is how I managed it using .htaccess:

RewriteEngine On
RewriteCond %{HTTPS} !on
RewriteRule (.*) https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]

<If "%{HTTPS} == 'on'">
    AuthType Basic
    AuthName "Restricted Files"
    AuthBasicProvider file
    AuthUserFile "/var/www/html/secrets/.passwd"
    Require valid-user
</If>

Best Answer

Related Solutions

Security – Is setting a Content Security Policy incompatible with Joomla’s admin page

Apache .htaccess – SSLRequireSSL Produces HTTP 500 Internal Server Error

Related Topic