HTTP Headers

miguelss

Hi OsTicket lovers ;-)

I want to implement in my OsTicket 1.18.x the correct HTTP Headers. Any sugestion?

Thanks in advance,

KevinTheJedi

miguelss

Sorry KevinTheJedi you are right. My message is a kind of encrytion one 😊
I mean, in Apache, what are the HTTP Headers , like this one:

Content-Security-Policy: default-src 'self'; script-src 'self' 'unsafe-inline'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; font-src 'self'; connect-src 'self'; object-src 'none'; base-uri 'self'; form-action 'self';
X-Content-Type-Options: nosniff
X-Frame-Options: SAMEORIGIN
X-XSS-Protection: 1; mode=block
Strict-Transport-Security: max-age=63072000; includeSubDomains; preload
Referrer-Policy: no-referrer-when-downgrade
Permissions-Policy: geolocation=(), microphone=(), camera=()

Hope that this is more clear now 🤣

KevinTheJedi

miguelss

We don't do any of those headers except the CSP header. The rest would be set at the webserver level or outside the osTicket software.

Cheers.

miguelss

KevinTheJedi Thanks a lot. As always you bring light to the dark 👍

KevinTheJedi

miguelss

You're welcome! Fyi, you can always check stuff like this yourself by searching in the Github repo and wrapping the search string in double quotes (for exact matches). So if you were looking to see if we set the Content-Security-Policy header you can search for "Content-Security-Policy" in the repo (like this).

Cheers.