CODEWITHSUNDEEP
amazon-web-servicesamazon-s3amazon-cloudfront
Adam
Adam

Reputation: 12650

Is it possible to set Content-Security-Policy headers in Amazon S3?

I'm trying to set a Content-Security-Policy header for an html file I'm serving via s3/cloudfront. I'm using the web-based AWS console. Whenever I try to add the header:

enter image description here

it doesn't seem to respect it. What can I do to make sure this header is served?

Upvotes: 15

Views: 35427

Answers (5)

charlie
charlie

Reputation: 1527

As of 2024

  1. In CloudFront > Policies > Response headers > Custom policies, create a new policy, where:

    • in Security headers, enable Content-Security-Policy
      • specify its value: default-src 'self'
    • configure other headers, if needed (CORS, other Security headers, Custom headers, ...)

  2. In Distributions > ${distributionName} > Behaviours > Default (*)

    • in Response headers policy, choose the Custom policy created in step 1.

Upvotes: 2

vedat
vedat

Reputation: 1309

not on S3 but you can do it on CloudFront...

go to your distribution -->Behaviours--> default (or if you are using a different one) -> Edit --> Under "Response headers policy" click "View Policy" ... then edit your response policy.. save it then our CF distribution will use this new response headers policy

Upvotes: 1

iBabur
iBabur

Reputation: 1004

S3/CloudFront takes any headers that the origin set and forward those to the client, but you can't set custom headers on you response directly.

You can use Lambda@Edge function that can inject security headers through CloudFront.

Here is how the process works: (reference aws blog)

  • Viewer navigates to website.
  • Before CloudFront serves content from the cache it will trigger any Lambda function associated with the Viewer Request trigger for that behavior.
  • CloudFront serves content from the cache if available, otherwise it goes to step 4.
  • Only after CloudFront cache ‘Miss’, Origin Request trigger is fired for that behavior.
  • S3 Origin returns content.
  • After content is returned from S3 but before being cached in CloudFront, Origin Response trigger is fired.
  • After content is cached in CloudFront, Viewer Response trigger is fired and is the final step before viewer receives content.
  • Viewer receives content.

Below is the blog from aws on how to do this step by step.

https://aws.amazon.com/blogs/networking-and-content-delivery/adding-http-security-headers-using-lambdaedge-and-amazon-cloudfront/

Upvotes: 6

Madhan Dennis
Madhan Dennis

Reputation: 400

If you are testing through CloudFront, have you made sure you have invalidated the cached objects? Can you try to upload a completely new file and then try accessing it via CF and see if the header is still not there?

Update

Seems like custom metadata will not work as expected as per DOC. Any metadata other than the ones supported by S3 (the ones displayed in the dropdown) will have to be prefixed with x-amz-meta-

Upvotes: 5

Ravenscar
Ravenscar

Reputation: 2880

I'm having the same problem (using S3/CloudFront) and it appears there is currently no way to set this up easily.

S3 has a whitelist of the headers permitted, and Content-Security-Policy is not on it. Whilst it is true you can use the prefixed x-amz-meta-Content-Security-Policy, this is unhelpful as there is no browser support for it.

There are two options I can see.

1) you can serve the html content from a webserver on an EC2 instance and set that up as another CloudFront origin. Not really a great solution.

2) include the CSP as a meta tag within your html document:

    <!doctype html>
    <html>
      <head>
        <meta http-equiv="Content-Security-Policy" content="default-src http://*.foobar.com 'self'">
...

This option is not as widely supported by browsers, but it appears to work with both Webkit and Firefox, so the current Chrome, Firefox, Safari (and IOS 7 Safari) seem to support it.

I chose 2 as it was the simpler/cheaper/faster solution and I hope AWS will add the CSP header in the future.

Upvotes: 10

Related Questions