Investigate CSP on static resources

[LukasReschke]

From IRC with @Raydiation:

15:22:35 <AnybodyElse> Raydiation: Yes. Easy.
15:23:38 → th3fallen joined (~th3fallen@206.74.96.146)
15:23:45 <AnybodyElse> Raydiation: Though something like that could also bite us if somebody ships an insecure HTML file since it has no CSP if it is not processed by PHP. Maybe worth to check which magic we could use to detect that as well…
15:25:22 <Raydiation> AnybodyElse: why not enhance the apache config file
15:25:33 <AnybodyElse> Raydiation: We would need to detect if already one is set etc.
15:25:40 <Raydiation> hm, not possible?
15:25:42 <AnybodyElse> Raydiation: Possible that this is possibly, that is what needs research! ;-)
15:25:50 <AnybodyElse> but busy with other things as usual
15:25:56 <AnybodyElse> but I will create a ticket for me
15:26:01 <Raydiation> http://serverfault.com/questions/520477/set-header-in-apache-if-it-doesnt-already-exist

[PVince81]

9.0 ?

[lock]

This thread has been automatically locked since there has not been any recent activity after it was closed. Please open a new issue for related bugs.