0

I have a wordpress website that runs on a LAMP system.

I tried to improve security (I'm far from being an expert!) and added a CSP header.

Header  set Content-Security-Policy "default-src 'self'; font-src 'self' data: https://fonts.gstatic.com; frame-src https://www.google.com https://www.youtube.com; img-src 'self' https://secure.gravatar.com; script-src 'self' 'unsafe-inline' ; style-src 'self' 'unsafe-inline' https://fonts.googleapis.com; object-src 'none'"

What I don't understand: If I remove the unsafe-inline from the script-src my calendar widget does not load anymore on a windows browser (tested both firefox and chrome). But it works on a Linux browser (Firefox).

Is this a bug in apache2, in the windows browsers or in the calender wp plugin?

I'm confused. :-)

Umbertones
  • 7
  • 3

2 Answers2

0

It doesn't look like an Apache bug, it just sends the CSP as a string without even understanding what's in it.

Of course you can use some User Agent conditions in the httpd.conf like:

SetEnvIfNoCase User-Agent "Linux x86_64" noCSP=1

and to publish CSP relying on noCSP flag to exclude CSP header for some kinds od user agents.
But you can easily clarify that and ensure you have the same CSP header for the Windows/Linux browsers.

I think a WP calendar plugin uses some inline scripts which are blocked in absence of 'unsafe-inline'. You can check accourding CSP errors in the browser console of windows browser.

Maybe you disabled CSP in your Linux Firefox browser (about:config page -> security.csp.enable -> false) or have some extensions which disable CSP.

granty
  • 7,234
  • 1
  • 14
  • 21
  • CSP is enabled in the Linux Firefox. I'm running very few extensions - the only one in the CSP regime is Laboratory but that is for creating a header for a website and does hopefully not influence Firefox behaviour (correction: it does - just found out that when recording a website csp is disabled - solution!) I have asked the plugin author whether he can clarify about the ```unsafe-inline``` in his plugin, but no answer so far. – Umbertones Nov 04 '21 at 12:20
0

So the different Windows/Linux behaviour comes from the Laboratory plugin that was running in my Linux Firefox. I have to check with the plugin author why unsafe-inline is required.

Umbertones
  • 7
  • 3