コミュニティアチーブメントバーを展開する。

Submissions are now open for the 2026 Adobe Experience Maker Awards.
解決済み

CSP headers not coming when status is 304(Not Modified)

Avatar

Level 4

Hello All,

 

We have implemented (Content Security Policy)CSP headers in our project in custom .vhost file I can see CSP headers when page status is 200. But if we refresh the same page it shows page status as 304 Not modified. In this case CSP headers are not loading and page is served from cache. But our client is having concern will it be a security threat if we reload page and CSP headers wont be there. Can anyone please provide some info on this?

1 受け入れられたソリューション

Avatar

正解者
Community Advisor

When a page is served from the browser cache with a "304 Not Modified" response, the CSP headers may not be explicitly shown in the response because the browser relies on the original CSP headers included in the cached page. You should ensure that CSP policies are correctly set in the initial response to maintain security when pages are served from the cache.

Arun Patidar

AEM LinksLinkedIn

元の投稿で解決策を見る

2 返信

Avatar

正解者
Community Advisor

When a page is served from the browser cache with a "304 Not Modified" response, the CSP headers may not be explicitly shown in the response because the browser relies on the original CSP headers included in the cached page. You should ensure that CSP policies are correctly set in the initial response to maintain security when pages are served from the cache.

Arun Patidar

AEM LinksLinkedIn

Avatar

Administrator

@supriya-hande  Did you find the suggestions from Arun helpful? Please let us know if more information is required. Otherwise, please mark the answer as correct for posterity. If you have found out solution yourself, please share it with the community.



Kautuk Sahni