1

My Line is as under in .htaccess

Header set Content-Security-Policy "script-src 'self' 'nonce-%{UNIQUE_ID}e'; style-src 'self' 'nonce-%{UNIQUE_ID}e';"

Please let me know how to convert %{UNIQUE_ID}e into base64 value in .htaccess.

2

If you are on Apache 2.4.10+ then you can use Apache expressions in the value argument of the Header directive. This gives you access to a base64 function that can be used to base 64 encode the UNIQUE_ID environment variable.

For example (untested):

Header set Content-Security-Policy "expr=script-src 'self' 'nonce-%{base64:%{reqenv:UNIQUE_ID}}'; style-src 'self' 'nonce-%{base64:%{reqenv:UNIQUE_ID}}';"

See also the following question which actually appears to have the same end goal (after reading the comments), although the suggested solution requires access to the server config (and PHP), which may be undesirable:

The following answer on StackOverflow also offers a solution that uses a server-side RewriteMap and an external program to do the base64 conversion. This would work on Apache 2.2 and earlier, but does require server access.

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.