Apache

Library

Learnings

• Header Overwrites/Preservation

Header Overwrites/Preservation

Apache less than 2.4.7 does not have the setIfEmpty verb. Looking up online I found a few SetEnv attempts of replicating setting a header variable if not already set that went along the lines of

1SetEnvIf X-My-Header "" no_my_header
2RequestHeader set X-My-Header "value" env=no_my_header

https://serverfault.com/questions/520477/set-header-in-apache-if-it-doesnt-already-exist

I've managed to get it working in a one liner

1Header set Content-Security-Policy "..." "expr=-z resp('Content-Security-Policy')"

• expr - the following is an expression to evaluate
• -z - return true if the following string is empty
• resp - function for looking up response header values
• Content-Security-Policy - the header in question

Nice way to preserve pre-set headers based on .htaccess inheritance. In this case, I'm adding data: to my Content-Security-Policy specifically for a pie-chart SVG to be able to use inline SVGs for patterns. So I can keep my fine-grained control.