Merge pull request #406 from jrafanie/set-csp-always

Set Content-Security-Policy with always flag for error responses

Author: Fryguy

COPY/etc/httpd/conf.d/manageiq-https-application.conf

@@ -30,7 +30,7 @@ SSLCertificateKeyFile /var/www/miq/vmdb/certs/server.cer.key
   Header always set Strict-Transport-Security   "max-age=631138519"
   # CSP for static assets: strict policy since these are pre-compiled external files
   # No unsafe-inline needed - all scripts/styles are external resources
-  Header set Content-Security-Policy            "default-src 'self'; base-uri 'self'; child-src 'self'; form-action 'self'; frame-ancestors 'self'; frame-src 'self'; worker-src 'self'; font-src 'self' fonts.gstatic.com fonts.googleapis.com; img-src 'self' data:; style-src 'self' fonts.googleapis.com fonts.gstatic.com; report-uri /dashboard/csp_report; report-to csp-endpoint"
+  Header always setifempty Content-Security-Policy "default-src 'self'; base-uri 'self'; child-src 'self'; form-action 'self'; frame-ancestors 'self'; frame-src 'self'; worker-src 'self'; font-src 'self' fonts.gstatic.com fonts.googleapis.com; img-src 'self' data:; style-src 'self' fonts.googleapis.com fonts.gstatic.com; report-uri /dashboard/csp_report; report-to csp-endpoint"
   Header set Report-To                          "{\"group\":\"csp-endpoint\",\"max_age\":10886400,\"endpoints\":[{\"url\":\"/dashboard/csp_report\"}]}"
   Header set X-Content-Type-Options             "nosniff"
   Header set X-Frame-Options                    "SAMEORIGIN"