"Apache: Unset the Content-Security-Policy header before setting it.

Prevents double occurences of the CSP header
OpenConext · Apr 17, 2024 · 98edda6 · 98edda6
1 parent 4804a15
commit 98edda6
Show file tree

Hide file tree

Showing 2 changed files with 2 additions and 0 deletions.
diff --git a/apache2/conf/openconext.conf b/apache2/conf/openconext.conf
@@ -9,5 +9,6 @@ CustomLog /proc/self/fd/1 openconext
 # Set the CSP header if it was defined as an env variable
 PassEnv HTTPD_CSP
 <If "osenv('HTTPD_CSP') != ''">
+    Header unset Content-Security-Policy
     Header always set Content-Security-Policy "${HTTPD_CSP}"
 </If>
diff --git a/php82-apache2/conf/openconext.conf b/php82-apache2/conf/openconext.conf
@@ -9,6 +9,7 @@ LogFormat "%h %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-Agent}i\" \"%{X-Re
 # Set the CSP header if it was defined as an env variable
 PassEnv HTTPD_CSP
 <If "osenv('HTTPD_CSP') != ''">
+    Header unset Content-Security-Policy
     Header always set Content-Security-Policy "${HTTPD_CSP}"
 </If>