How can I substitute the CSP nonce value in Angular index.html using Apache httpd.conf and...

Tried to setup CSP nonce in angular application hosted on apache httpd server using mod_cspnonce module.

Was able to construct the below policy and could see the response headers holds correct nonce- value.

Header set Content-Security-Policy "default-src 'self'; script-src http: https: 'unsafe-inline' 'unsafe-eval' 'strict-dynamic' 'nonce-%{CSP_NONCE}e'"



However, I couldn't substitute or setup the same nonce in index.html using httpd.conf.

index.html

<script src="https://../example1.js" nonce="CSP_NONCE"></script>
<script src="https://../example2.js" nonce="CSP_NONCE"></script>
<script src="https://../example3.js" nonce="CSP_NONCE"></script>


I've tried couple of options to replace CSP_NONCE keyword in index.html mentioned in csplite

• mod_substitute (link)

<Location />
AddOutputFilterByType SUBSTITUTE text/html
Substitute "s|CSP_NONCE|nonce-%{CSP_NONCE}e|i"
</Location>

• mod_sed (link)

<Directory "/">
AddOutputFilter Sed html
OutputSed "s/CSP_NONCE/nonce-%{CSP_NONCE}e/g"
</Directory>


Both these options return only string literal in the response, but not the expected substituted nonce value.

References:

https://csplite.com/csp220

https://github.com/wyday/mod_cspnonce

Any suggestions would be helpful!

Continue reading...