The Content-Security-Policy header must not be overridden
- Dominant language
- HTML
- Stars
- 40
- Forks
- 133
- Avg merge
- 1h 3m
- Merged PRs (30d)
- 8
Description
https://github.com/apache/arrow-site/blob/0a7594a059837f9324ee769fa29c5e84d6103156/.htaccess#L31
The Content-Security-Policy header must not be overridden.
There is now a standard way to add local exceptions to the CSP:
https://infra.apache.org/tools/csp.html
Please update the .htaccess file accordingly.
Contributor guide
No contributing guide indexed for this repository
Research direction
Open the .htaccess file at the referenced line and read the Apache CSP guidance at infra.apache.org/tools/csp.html. Update the configuration so the Content-Security-Policy header is not overridden while using the documented mechanism for local exceptions. Done means the site configuration follows that standard and preserves the intended CSP behavior.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- apache
- Domain
- security, web-dev
- Issue type
- Bug
- Difficulty
- 2/5
- Estimated time
- 1-3 hours
- Activity status
- Quiet
- Clarity
- Clearly specified
- Newbie friendliness
- 78/100