From baff94e04401325bbe283a56cc3340cc57729a09 Mon Sep 17 00:00:00 2001
From: Jesse Norell <jesse@kci.net>
Date: Mon, 6 Jul 2020 17:33:29 -0600
Subject: [PATCH] vary CSP header for HTTP and HTTPS, and secure cookies
---
install/tpl/apache_ispconfig.vhost.master | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
diff --git a/install/tpl/apache_ispconfig.vhost.master b/install/tpl/apache_ispconfig.vhost.master
index d8c56de22d..61e9a58859 100644
--- a/install/tpl/apache_ispconfig.vhost.master
+++ b/install/tpl/apache_ispconfig.vhost.master
@@ -89,11 +89,13 @@ NameVirtualHost *:<tmpl_var name="vhost_port">
<IfModule mod_headers.c>
# ISPConfig 3.1 currently requires unsafe-line for both scripts and styles, as well as unsafe-eval
+ Header set Content-Security-Policy "default-src 'self' 'unsafe-inline' 'unsafe-eval'; img-src 'self' data:; object-src 'none'"
<tmpl_var name="ssl_comment">Header set Content-Security-Policy "default-src 'self' 'unsafe-inline' 'unsafe-eval'; img-src 'self' data:; object-src 'none'; upgrade-insecure-requests"
Header set X-Content-Type-Options: nosniff
Header set X-Frame-Options: SAMEORIGIN
Header set X-XSS-Protection: "1; mode=block"
- <tmpl_var name="ssl_comment">Header always edit Set-Cookie (.*) "$1; HTTPOnly; Secure"
+ Header always edit Set-Cookie (.*) "$1; HTTPOnly"
+ <tmpl_var name="ssl_comment">Header always edit Set-Cookie (.*) "$1; Secure"
<IfVersion >= 2.4.7>
Header setifempty Strict-Transport-Security "max-age=15768000"
</IfVersion>
--
GitLab