apache / apache/arrow-site

The Content-Security-Policy header must not be overridden

Open Beginner friendly
#723 6 comments 0 reactions 0 assignees View on GitHub
Dominant language
HTML
Stars
40
Forks
133
Avg merge
1h 3m
Merged PRs (30d)
8

Description

https://github.com/apache/arrow-site/blob/0a7594a059837f9324ee769fa29c5e84d6103156/.htaccess#L31

The Content-Security-Policy header must not be overridden.

There is now a standard way to add local exceptions to the CSP:

https://infra.apache.org/tools/csp.html

Please update the .htaccess file accordingly.

Contributor guide

No contributing guide indexed for this repository

Research direction

Open the .htaccess file at the referenced line and read the Apache CSP guidance at infra.apache.org/tools/csp.html. Update the configuration so the Content-Security-Policy header is not overridden while using the documented mechanism for local exceptions. Done means the site configuration follows that standard and preserves the intended CSP behavior.

Written by the indexing model from the issue text.

Assessment

Tech stack
apache
Domain
security, web-dev
Issue type
Bug
Difficulty
2/5
Estimated time
1-3 hours
Activity status
Quiet
Clarity
Clearly specified
Newbie friendliness
78/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.