Assign CSP header default to 'report-only'

Update default CSP 'repsonse_header' setting to be 'Content-Security-Policy-Report-Only'.
artefactual · Nov 1, 2023 · 5f074ab · 5f074ab
1 parent 06178a0
commit 5f074ab
Show file tree

Hide file tree

Showing 2 changed files with 2 additions and 2 deletions.
diff --git a/config/app.yml b/config/app.yml
@@ -65,6 +65,6 @@ all:
   csp:
       # Configure CSP response header to be either
       # 'Content-Security-Policy-Report-Only' or 'Content-Security-Policy'
-      response_header: Content-Security-Policy
+      response_header: Content-Security-Policy-Report-Only
       # Configure CSP response directives.
       directives: "default-src 'self'; font-src 'self'; img-src 'self' https://www.gravatar.com/avatar/ blob:; script-src 'self' 'nonce'; style-src 'self' 'nonce'; worker-src 'self' blob:; frame-ancestors 'self';"
diff --git a/docker/bootstrap.php b/docker/bootstrap.php
@@ -105,7 +105,7 @@ function get_host_and_port($value, $default_port)
   read_only: false
   htmlpurifier_enabled: false
   csp:
-    response_header: Content-Security-Policy
+    response_header: Content-Security-Policy-Report-Only
     directives: "default-src 'self'; font-src 'self'; img-src 'self' https://www.gravatar.com/avatar/ blob:; script-src 'self' 'nonce'; style-src 'self' 'nonce'; worker-src 'self' blob:; frame-ancestors 'self';"
 EOT;