Feature request: Possibility to run both Report-Only and

Hi

We are in a transition of CSP settings from our side into the Stott.Security plugin.

We were wondering if it is possible to both run the report-only feature alongside the CSP header settings via this plugin so that we may provide the reporting simultaneously as we try to migrate each ruleset to the real deal?

With other words, is it possible to run both headers simultaneously?

[GeekInTheNorth]

Hello Eric,

The AddOn does not support doing this right now and it would take some effort to implement. However, if you are implementing one CSP in a middleware in your own code and another through the AddOn, then it will depend on the sequence of the middleware are executed. So long as you use the Append method, you could emit your own hard coded CSP while the AddOn could be kept in reporting mode until you're ready.

Please note that where one or more Content Security Policy headers are returned, when the browser assesses whether a permission should be granted, it will apply the most restrictive header.

I would add that as of version 3.0.2 I've added some conditional handling of the CSPs to protect access the website. If you're not aware, please note that Cloudflare CDN has the following header size limits:

• 16KB for all headers with the same name
• 32KB for all headers

If these limits are exceeded then the response will be dropped by Cloudflare. As far as the webserver is concerned, a successful response was served. As far as the browser is concerned, the response is still pending and it will wait for a response that never comes.

---

I am currently planning an overhaul to how CSPs are maintained in the AddOn as I want to provide the ability to manage multiple CSPs for different contexts such as:

• Site
• Host
• Specific Paths
• Content Routes
• Non-Content Routes

I knocked this up in DevTools to help conceptualize this with a colleague earlier this week, I could look at factoring this idea in as well: