CSP - What change needed in Code level to configure - Nonce in apachectl

[Raj Ravi]

Hi,

I am trying to enforce CSP configruation in my Gerrit System. 

If i configure below in my apache, Gerrit page is not working. Is there any changes needed in code level to accpect this config or i have to make different script-src config? 

 Header always set Content-Security-Policy "default-src 'self';script-src  'nonce-%{UNIQUE_ID}e' 'unsafe-inline' ;

Regards,

Raj

[Nasser Grainawi]

On Wed, Jul 29, 2026 at 12:59 AM Raj Ravi <keerthish...@gmail.com> wrote:

Hi,

I am trying to enforce CSP configruation in my Gerrit System. 

If i configure below in my apache, Gerrit page is not working. Is there any changes needed in code level to accpect this config or i have to make different script-src config? 

Likely you need code changes. I created this change (unmerged) recently when I was encountering some CSP-related issues (or so I thought). You might find it helpful as a reference: 600121: Replace default X-Frame-Options DENY with CSP frame-ancestors 'self' | https://gerrit-review.googlesource.com/c/gerrit/+/600121

I'm not 100% clear on what exactly you want Gerrit to do though, so you might need to clarify that more. Are you trying to do something like this? Mitigate cross-site scripting (XSS) with a strict Content Security Policy (CSP)  |  Articles  |  web.dev

Nasser

 

 Header always set Content-Security-Policy "default-src 'self';script-src  'nonce-%{UNIQUE_ID}e' 'unsafe-inline' ;

Regards,

Raj

--
--
To unsubscribe, email repo-discuss...@googlegroups.com
More info at http://groups.google.com/group/repo-discuss?hl=en

---
You received this message because you are subscribed to the Google Groups "Repo and Gerrit Discussion" group.
To unsubscribe from this group and stop receiving emails from it, send an email to repo-discuss...@googlegroups.com.
To view this discussion visit https://groups.google.com/d/msgid/repo-discuss/e1540fae-e22d-4426-86d9-9fff26031015n%40googlegroups.com.