Content Security Policy as code
Every new marketing vendor meant hand-editing long security headers in several places per environment. We turned it into a small build step: readable source in, consistent Dispatcher config out.
Client
- Enterprise client
- Name withheld
Our role
- Design and build
- Dispatcher ownership
Stack
- AEM as a Cloud Service
- Dispatcher (Apache)
- Python
- Cloud Manager
The challenge
A Content Security Policy tells browsers which scripts and services a page may load. Each new vendor, whether forms, analytics, video or bot protection, meant editing long policy strings by hand in several virtual hosts, for every environment. Environments drifted, a script would work on stage and break in production, and every release carried risk.
The approach
We wrote a small build tool. Each site and environment gets a readable source file with comments; the tool renders them into the include files the Dispatcher loads, enforces directive order, and shows a diff against the current config before anything is written.
- Request filtering moved to deny-by-default, with explicit allow rules
- Error pages moved from AEM to the Dispatcher
- A documented gotcha: Dispatcher-only pipelines deploy committed files as-is, so generated output is regenerated and committed with every change
Results
- A policy change is one reviewed edit, consistent everywhere
- New vendors integrate without touching virtual hosts by hand
- Environments stop drifting apart
Is your platform telling you something?
An AEM health check is the fastest way to find out what’s fragile before it breaks.
Book a health check