alex
/
PNSPS-frontend-MaterialUI
2
0
Fork 0
Code Issues 0 Pull Requests 0 Releases 0 Wiki Activity
You can not select more than 25 topics Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
1599 Commits
6 Branches
28 MiB
 
 
Tree: 06acc53c99
Branches Tags
${ item.name }
Create branch ${ searchTerm }
from '06acc53c99'
${ noResults }
PNSPS-frontend-MaterialUI/docs/csp-apache.conf.md

2.5 KiB
Raw Blame History

Content-Security-Policy (Apache)

Self-hosted fonts: no fonts.googleapis.com or fonts.gstatic.com. Static assets (including woff2) are served from 'self'.

Adjust report-uri if your API base path or host differs (UAT example below; PROD uses https://pnsps.gld.gov.hk/api/csp-report).

See also: csp-report-review-2026-08-03.md for the PROD report analysis that drove frame-src / media-src updates.

Enforcing

Header always set Content-Security-Policy "default-src 'self'; \
	base-uri 'self'; \
	object-src 'none'; \
	frame-ancestors 'none'; \
	form-action 'self'; \
	frame-src 'self' data: blob:; \
	script-src 'self'; \
	style-src 'self' 'unsafe-inline'; \
	style-src-elem 'self' 'unsafe-inline'; \
	img-src 'self' data: https://www.w3.org https://w3.org; \
	media-src 'self' blob: data:; \
	font-src 'self' data:; \
	connect-src 'self'; \
	upgrade-insecure-requests"

Report-Only

Same policy plus violation reporting:

Header always set Content-Security-Policy-Report-Only "default-src 'self'; \
	base-uri 'self'; \
	object-src 'none'; \
	frame-ancestors 'none'; \
	form-action 'self'; \
	frame-src 'self' data: blob:; \
	script-src 'self'; \
	style-src 'self' 'unsafe-inline'; \
	style-src-elem 'self' 'unsafe-inline'; \
	img-src 'self' data: https://www.w3.org https://w3.org; \
	media-src 'self' blob: data:; \
	font-src 'self' data:; \
	connect-src 'self'; \
	upgrade-insecure-requests; \
	report-uri https://pnspsuat.gld.gov.hk/api/csp-report"

Notes

  • frame-src: Required for proof file preview iframes that use data: / blob: URLs (UploadFileTable.js). Without this, framing falls back to default-src 'self' and browsers report frame-src violations (often with empty blocked-uri).
  • style-src-elem: Explicit, alongside style-src, for <link rel="stylesheet"> behaviour in modern browsers.
  • img-src: Includes https://www.w3.org and https://w3.org so W3C WCAG badge URLs are allowed.
  • media-src: blob: for captcha audio object URLs; data: for data-URI media if used.
  • font-src: 'self' data: covers bundled fonts and data: URLs if used.
  • Report noise: Browser extensions (Kaspersky, Perplexity, Youdao, Quark, Google Fonts injected by tooling, wasm-eval from chrome-extension) will still appear under Report-Only. Do not allowlist those origins.
  • Add origins to the relevant directive only if you introduce third-party scripts, styles, fonts, or APIs that the application itself loads.