How to add custom meta tags

Developing for Dolibarr
1

I’m having trouble serving woff2 fonts, for which I need to add meta tags like these -

http-equiv="Content-Security-Policy" content="font-src 'self' data:; img-src 'self' data:; default-src 'self' http://121.0.0:3000/"

I tried adding them using the main.inc.php file, but I start getting 500 Internal Server Error every time I add it. It would be great if you guys could suggest a way to add it.
Thanks!

2

Didn’t you forget to add it as a real meta tag element like that:

<meta http-equiv="Content-Security-Policy" content="font-src 'self' data:; img-src 'self' data:; default-src 'self' http://121.0.0:3000/">
  1. Meta tag should be placed into <head> section, otherwise it will fail to work. Adding tags into <head> is safe enough and can’t cause 500 Internal Server Error.
  2. Meta tag does not support Content-Security-Policy-Report-Only header which is preferred on time of debug CSP. It does not perform real blocking, but you can see in the browser cionsole do you have blocked anithing else. And after debug change it to enforced Content-Security-Policy.
  3. Preferred way to publish CSP is HTTP header, so it’s better to use in PHP:
    header("Content-Security-Policy: font-src 'self' data:; img-src 'self' data:; default-src 'self' http://121.0.0:3000/");
    The header() funct should be placed in the top of PHP-file, before any output to browser.
  4. Are you sure you do not already publish CSP via some plugin or web server config? In case of 2 CSPs published at the same time they operates a tricky way - all rules combines with logical “AND”. So resulting CSP can become more harden only.