title: Setting Content Security Policy in Apache web server
body: <p>We had a penetration testing and one of the findings were:</p>
  
  <p><em>"Missing Content-Security-Policy HTTP response header"</em></p>
  
  <p>We did a bit of research and found out how to set this in the web servers httpd.conf file. The problem is we don't know what to include exactly. Our web app doesn't really have any dependencies to external sites like googleapis or any CDN or external images on the net. So, we aren't really sure what to put.</p>
  
  <p>Below is a sample but this has dependencies to some google links. </p>
  
  <pre><code>&lt;Location "/CompanyXYZ/"&gt;
  Header always append X-Frame-Options deny
  Header always set Content-Security-Policy "default-src 'self' data: blob: *.google.com *.gstatic.com; style-src 'self' 'unsafe-inline' *.google.com *.googleapis.com; script-src 'self' 'unsafe-inline' *.googleapis.com *.google.com;"
  &lt;/Location&gt;
  </code></pre>
  
  <p>What if we have none of those dependencies? how should we set ours?</p>