Expand my Community achievements bar.

Enhance your AEM Assets & Boost Your Development: [AEM Gems | June 19, 2024] Improving the Developer Experience with New APIs and Events
SOLVED

CSP headers not coming when status is 304(Not Modified)

Avatar

Level 4

Hello All,

 

We have implemented (Content Security Policy)CSP headers in our project in custom .vhost file I can see CSP headers when page status is 200. But if we refresh the same page it shows page status as 304 Not modified. In this case CSP headers are not loading and page is served from cache. But our client is having concern will it be a security threat if we reload page and CSP headers wont be there. Can anyone please provide some info on this?

1 Accepted Solution

Avatar

Correct answer by
Community Advisor

When a page is served from the browser cache with a "304 Not Modified" response, the CSP headers may not be explicitly shown in the response because the browser relies on the original CSP headers included in the cached page. You should ensure that CSP policies are correctly set in the initial response to maintain security when pages are served from the cache.



Arun Patidar

View solution in original post

2 Replies

Avatar

Correct answer by
Community Advisor

When a page is served from the browser cache with a "304 Not Modified" response, the CSP headers may not be explicitly shown in the response because the browser relies on the original CSP headers included in the cached page. You should ensure that CSP policies are correctly set in the initial response to maintain security when pages are served from the cache.



Arun Patidar

Avatar

Administrator

@supriya-hande  Did you find the suggestions from Arun helpful? Please let us know if more information is required. Otherwise, please mark the answer as correct for posterity. If you have found out solution yourself, please share it with the community.



Kautuk Sahni