CSP headers not coming when status is 304(Not Modified)

[supriya-hande]

Hello All,

We have implemented (Content Security Policy)CSP headers in our project in custom .vhost file I can see CSP headers when page status is 200. But if we refresh the same page it shows page status as 304 Not modified. In this case CSP headers are not loading and page is served from cache. But our client is having concern will it be a security threat if we reload page and CSP headers wont be there. Can anyone please provide some info on this?

[arunpatidar · Accepted solution]

When a page is served from the browser cache with a "304 Not Modified" response, the CSP headers may not be explicitly shown in the response because the browser relies on the original CSP headers included in the cached page. You should ensure that CSP policies are correctly set in the initial response to maintain security when pages are served from the cache.

[kautuk_sahni]

@supriya-hande  Did you find the suggestions from Arun helpful? Please let us know if more information is required. Otherwise, please mark the answer as correct for posterity. If you have found out solution yourself, please share it with the community.