Mailing-List: contact users-help@httpd.apache.org; run by ezmlm
Precedence: bulk
Reply-To: users@httpd.apache.org
Reply-To: lspeciale@gmail.com
To: users@httpd.apache.org
References: <4a513065-4a8c-99c3-754c-f2c8e7a28339@gmail.com>
 <3fe3858d-7070-c49b-259d-d9eed52c5ef6@apache.org>
 <3f9021f2-0908-db16-ae88-ffcca271f9f4@gmail.com>
 <af5af378-c8f0-6486-54e5-572c34716d16@apache.org>
 <e8872030-465c-ae04-87e3-43667b7d6090@gmail.com>
 <3144da0d-40ed-6197-b020-a7c791e1e04a@apache.org>
 <03d1f078-da10-07c5-df30-79d3f8ac49e8@gmail.com>
 <e3fec7d8-dafb-30ac-bf31-ac806d029e0a@apache.org>
 <874d2842-296e-fb7c-c24a-fc5c482ad093@gmail.com>
 <etPan.59b6598c.2f92c0e.30e@airmail.rr>
 <4e479d55-194b-fbc8-1c65-09bfeac2214b@gmail.com>
 <e568eac1-e601-828c-0495-a132197cde06@apache.org>
 <79178259-8453-5502-5ea4-811047122e09@gmail.com>
 <d4c94c47-69c3-ac42-a503-45699b93459a@apache.org>
From: Luis Speciale <lspeciale@gmail.com>
Message-ID: <b346310f-8b7e-53dd-4100-135c123179e5@gmail.com>
Date: Mon, 11 Sep 2017 20:40:44 +0200
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.12; rv:52.0)
 Gecko/20100101 Thunderbird/52.3.0
MIME-Version: 1.0
In-Reply-To: <d4c94c47-69c3-ac42-a503-45699b93459a@apache.org>
Content-Type: text/plain; charset=utf-8; format=flowed
Content-Language: en-GB
Content-Transfer-Encoding: 8bit
Subject: Re: [users@httpd] CSP nonces in apache (SOLVED)
archived-at: Mon, 11 Sep 2017 18:40:52 -0000

Le 11/09/2017 à 17:12, Daniel Gruno a écrit :

For those who wont to accept inline scripts and styles with a nonce 
according to the CSP directives.

You must reinstall your apache server with lua support.
In my Mac I had installed httpd2.4 with brew

Open
	/usr/local/Homebrew/Library/Taps/homebrew/homebrew-apache/httpd24.rb
and add
	--enable-lua

In the args section and save it

args = %W[
...
       --enable-lua
...
     ]
Then stop and reinstall apache

	sudo apachectl stop
	brew reinstall httpd24

Edit httpd.conf and add mod_lua

	LoadModule lua_module libexec/mod_lua.so


Add this two lines in your httpd-vhosts.conf
	LuaOutputFilter fixupNonce /usr/local/var/www/nonce.lua nonce
	SetOutputFilter fixupNonce
	

Put this text in /usr/local/var/www/nonce.lua

-- Thanks to Daniel Gruno humbedooh@apache.org who did… almost everything!
function fixNonce(stype, str)
	-- If it has a source, it's not inline
	if str:match("src=") then
		return ("<%s%s>"):format(stype, str)
	else
	-- If not, we add the nonce
		return ("<%s nonce-%s %s>"):format(stype, nid, str)
	end
end
function nonce(r)
	coroutine.yield()
	-- Make a random nonce ID for this session
	nid = r:sha1(math.random(1,999999999)..r.useragent_ip)
	-- Set the CSP headers here instead of httpd.config and give the var 
nid to nonce-
	r.err_headers_out['X-Content-Security-Policy'] = "default-src 'self'; 
connect-src 'self' ; script-src 'self' 'nonce-"..nid.."'; style-src 
'self' 'nonce-"..nid.."' font-src 'self'; frame-ancestors 'self'; 
object-src 'none'; sandbox allow-forms allow-same-origin allow-scripts 
allow-popups allow-modals allow-orientation-lock allow-pointer-lock 
allow-presentation allow-popups-to-escape-sandbox; base-uri 
'self';report-uri / https://••••••YOURSITE••••••••/CSP_URI.php"		
	-- For each bucket, substitute script/style if inline
	while bucket do	
		bucket = bucket:gsub("<(script)(%s*.-)>", fixNonce)
		bucket = bucket:gsub("<(style)(%s*.-)>", fixNonce)
		coroutine.yield(bucket)
	end
end


And start apache.

Test it with

<!doctype html>
<html class="no-js" lang="en">
<head>
	<meta charset="utf-8">
	<title>::CSP::</title>
	<meta name="description" content="fait des sites avec SPIP">
</head>
<body>
<h5>
	Hello!
</h5>
<script>
	console.log("It Works!");
</script>
<style>	
	h5 {color:#900;}
</style>
</body>
</html>

You should have a red h5 and a console.log that confirms It works!

Et voilà!


Thanks again Daniel!

Luis


---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
For additional commands, e-mail: users-help@httpd.apache.org