Editing Apache Hardening (section)

== Content Security Policy ==
Content Security Policies are one of the more complex aspects to configure in Apache.  There purpose is to cover from where aspects of the page (e.g. JavaScript, CSS, images, fonts, etc.) can be provided.  Also, it covers how they can be provided, mainly in the case of JavaScript whether they can be inline or evaluated scripts.  EPrints repository software currently uses some inline scripts, so the benefits of the Content Security Policy are limited due to this.  However, EPrints repository software development is working towards eliminating use of inline JavaScript, so that a more secure Content Security Policy can be used.  At present the following policy is recommended.  It should work for vanilla EPrints repositories that only use common Bazaar plugins (e.g. IRStats2, etc.):
 Header set Content-Security-Policy "default-src 'none'; script-src 'self' 'unsafe-inline' www.google.com www.gstatic.com; connect-src 'self'; img-src 'self'; style-src 'self' 'unsafe-inline' www.gstatic.com; base-uri 'self'; form-action 'self'; font-src 'self'
Like other Apache hardening configuration, this is best added to a file under Apache configuration directory so it is applied to all virtualhosts.  However, if you are running other websites that do no have inline JavaScript, it may be better to add this line inside the HTTP and HTTPS virtualhosts for the EPrints repository in their archive's ''cfg/apachevhost.conf'' and ''ssl/securevhost.conf'' configurations.

The policy above currently only includes '' 'unsafe-inline' '' needed for inline JavaScript.  It has been reported that sometimes EPrints repositories will use evaluated JavaScript, so it may be necessary to add '' 'unsafe-eval' '' to the ''script-src'' section.

It is to be expected that many bespoke modifications or addition of Bazaar plugins will lead to you needing to update your Content Security Policy.  In particular if your rebranding your repository, as this will commonly use CSS, JavaScript, images and fonts from remote hosts.