How To Add CSP frame ancestors in Wordpress Website? [closed]

Question

I'm trying to add Content Security Policy (CSP) frame ancestors in .htaccess file to prevent our website from getting iframed on other websites.

Following is the code:

<IfModule mod_headers.c>
Header set Content-Security-Policy "frame-ancestors 'self';"
</IfModule>

This requires mod_headers to be enabled.
But when we enable mod_headers, it gives us Internal Server Error.

Note: We have a plugin installed that uses mod_header in .htaccess. Prevent other sites from showing my site via iframe

Note 2: I am using Apache2 Server

Note 3 (Very Important): When we remove the mod_headers added by the above plugin, the CSP header gets added and no error is encountered. But we do not want to remove the plugin / mod_headers added by the plugin.

Following is the error reported in apache's error logs-
/var/www/html/.htaccess: SetEnvIfNoCaseHeader name regex could not be compiled.In .htaccess, this is the part where SetEnvIfNoCaseHeader is getting used -

# Force deflate for mangled headers
<IfModule mod_setenvif.c>
<IfModule mod_headers.c>
SetEnvIfNoCase ^(Accept-EncodXng|X-cept-Encoding|X{15}|{15}|-{15})$ ^((gzip|deflate)\s*,?\s*)+|[X-]{4,13}$ HAVE_Accept-Encoding
RequestHeader append Accept-Encoding "gzip,deflate" env=HAVE_Accept-Encoding
# Don't compress images and other uncompressible content
SetEnvIfNoCase Request_URI \
\.(?:gif|jpe?g|png|rar|zip|exe|flv|mov|wma|mp3|avi|swf|mp?g|mp4|webm|webp|pdf)$ no-gzip dont-vary
</IfModule>
</IfModule>

Please Note:
Server version: Apache/2.4.41 (Ubuntu)

Answer 1

SetEnvIfNoCase ^(Accept-EncodXng|X-cept-Encoding|X{15}|{15}|-{15})$ ^((gzip|deflate)\s*,?\s*)+|[X-]{4,13}$ HAVE_Accept-Encoding

The regex ^(Accept-EncodXng|X-cept-Encoding|X{15}|{15}|-{15})$ is invalid, hence the error you are getting. Specifically, the error is here:

^(Accept-EncodXng|X-cept-Encoding|X{15}|{15}|-{15})$
---------------------------------------^

{15} is a quantifier, but the preceding token | is not quantifiable, since this is itself a special meta character. There is something missing. But it's not clear what this should be just by looking at the regex. However, it's possible this rule is based on the findings of this PDF/slides from 2009 (regarding mangled Accept-Encoding headers) so would make the missing character a ~ (tilde) - but that list is far from exhaustive (and in most cases the Accept-Encoding header is stripped entirely, which this rule does not check for). For example:

^(Accept-EncodXng|X-cept-Encoding|X{15}|~{15}|-{15})$

Or you could just make the regex valid by removing that part of the alternation altogether. For example:

^(Accept-EncodXng|X-cept-Encoding|X{15}|-{15})$

Although this and the following RequestHeader directive are only to "fix a mangled" Accept-Encoding header, and in the majority of cases where this would apply, the Accept-Encoding header is stripped entirely (which this rule does not check for). It's debatable whether this is required with today's web.

Just by looking at this rule block it's not clear whether the second SetEnvIfNoCase directive is required or not. (Although I assume you are compressing the response with Apache?)

Needless to say, this error has little to do with mod_headers. It just so happens that this directive is inside an <IfModule mod_headers.c> container.