Hi @Eduard Lebedyuk , I was testing various options for configuring Apache (RHEL in my case), so I read the documentation (unbelievable, isn't it? 😂) and performed a number of tests, the I found this article in the community and....I was kind of surprised because you suggest using CSP On/Off within a <VirtualHost> directive block.
I was surprised because the I excluded using <VirtualHost> directive block since the documentation suggests not using it (emphasis mine):
Note:
Although the Web Gateway supports the use of virtual host names in application access profiles, issuing Apache configuration directives to invoke the Web Gateway (that is, CSPFileTypes and CSP On/Off) within a <VirtualHost> directive block is not supported and will yield an error. In other words, you cannot enable the Web Gateway for the desired Virtual Hosts alone; you must enable the Web Gateway within the web server’s global configuration.
My my first thought was, well, this is a case where the documentation is wrong, sometimes it has happened.
At that point I was puzzled, so I tried using <VirtualHost> and, to my surprise, it worked!
Then I tried to validate my Apache config using "apachectl configtest" and:
[root@localhost conf]# apachectl configtest
[Sat Dec 21 17:22:39.632408 2024] [:warn] [pid 151005:tid 151005] Apache Configuration: CSP directive 'csp' detected in VirtualHost, only supported at default server level
[Sat Dec 21 17:22:39.632471 2024] [:warn] [pid 151005:tid 151005] Apache Configuration: CSP directive 'csp' detected in VirtualHost, only supported at default server level
[Sat Dec 21 17:22:39.632480 2024] [:warn] [pid 151005:tid 151005] Apache Configuration: CSP directive 'csp' detected in VirtualHost, only supported at default server level
Syntax OK
Not only is documented that using CSP On/Off within a <VirtualHost>, there is also some code implemented in CSPa24.so IRIS module to check for this and provide a warning message that says this is not supported.
Personally I'll avoid using CSP On/Off within a <VirtualHost> (at least) in production systems, unless some more info is found on this.
- Log in to post comments
.png)