0

I can't get my mind wrapped around the comments and way of coding, to set a header only for .html in for example the .htaccess file in html5 boilerplate.

The clue for a big codeblock lays in the fact that 'mod_headers can't match on the content type' (as # commented). So I wander 1: why is there a 'Header unset' in a <FilesMatch>, that just has been announced to be impossible?

<IfModule mod_headers.c>  

   Header set Content-Security-Policy "script-src 'self'; object-src 'self'"  

   # `mod_headers` cannot match based on the content-type, however,
   # the `Content-Security-Policy` response header should be send
   # only for HTML documents and not for the other resources.  

   <FilesMatch "\.(appcache|atom|bbaw|bmp|crx|css|cur|eot|f4[abpv]|flv|geojson|gif|htc|ico|jpe?g|js|json(ld)?|m4[av]|manifest|map|mp4|oex|og[agv]|opus|otf|pdf|png|rdf|rss|safariextz|svgz?|swf|topojson|tt[cf]|txt|vcard|vcf|vtt|webapp|web[mp]|woff2?|xloc|xml|xpi)$">
     Header unset Content-Security-Policy
   </FilesMatch>  

</IfModule>

I looked everywhere, but only land on pages that have the same, almost ritual used codeblock, without further explanation. So question 2: why is a simple declaration like this not possible?: 

<IfModule mod_headers.c>

  # Content-Security-Policy for .html files
  <FilesMatch "\.(html)$">
    Header set Content-Security-Policy "script-src 'self'; object-src 'self'"
  </FilesMatch>

  # OR like this 
  <Files ~ "\.(html)$">
    Header set Cache-Control "public, must-revalidate"
  </Files>  

</IfModule>
E.C.Pabon
  • 265
  • 1
  • 9
  • 1
    because `` deals with on-disk files. without opening the file and doing mime-type determination from magic numbers, the **ONLY** information available to apache is the filename and whatever `stat()` will return. it doesn't scan the rest of the apache config to realize that you configured files with `.arglebargle` for an extension to served up as `text/javascsript`, it just sees `foo.arglebargle` as a filename. – Marc B Mar 21 '16 at 22:05
  • Sorry, I can't understand your explanation. Any advice what to read? – E.C.Pabon Mar 21 '16 at 22:18

1 Answers1

1

It is possible to do that as per your second example. But .html are not the only files that could be sent as documents. You could also use .php or .htm or any other number of files. Some of these (like .php) may execute and then ultimately return HTML but the server doesn't know that as all it knows at this stage is the file extension.

CSP should be set on all documents but, to save header bandwidth, does not need to be set on assets used by those documents (e.g. images, style sheets, javascript... etc). Other than wasted bandwidth there is no really harm in setting it on other documents.

Ideally you would set it based on the mime-type returned (which in the PHP example above would be HTML). So anytime a HTML document is returned then set it, else don't. However as this is not possible you're left with two choices:

  1. Set it on everything by default but then explicitly unset it for known media types. This pretty much guarantees it will be set on the document but also risks it being set on a few other file types (e.g. if you don't explicitly unset it for that type) - which, as I say isn't really that bad.

  2. Explicitly state your HTML document types (like your second example). The risk here is you miss a file type (e.g. .php) either now or when someone else starts using php on your site in future.

The first option is the safer option. Particularly for html5boiler plate where they have no idea what technology will be used on the site it's used on. A site might use .php, .cgi, .asp or any number of technologies to generate the HTML document. They could even proxy the request to a back end server so they would be no file extension.

Make sense?

Barry Pollard
  • 40,655
  • 7
  • 76
  • 92
  • So I am mislead by `mod_headers` cannot match based on the content-type? It can, but you must be sure to match on the right file extension (on disk). What brings me to the next problem: a html file with some including php in it. Should I also match with .php? – E.C.Pabon Apr 09 '16 at 10:50
  • If it's setting it based on file extension then it's not setting it based on content type! Often they are the same (e.g. a .html file will return s text/html content type) but for dynamic content (e.g. php scripts) they will be different. Anyway just return CSP header for .php too as those will return documents too. – Barry Pollard Apr 09 '16 at 10:57