AWS CloudFront CSP Setup Guide

• An AWS account with CloudFront access
• An existing CloudFront distribution
• A CSP Warden account with a verified domain
• Your domain reporting token (found in your CSP Warden dashboard)

CloudFront supports custom response headers natively via Response Headers Policies. In the AWS Console, navigate to CloudFront > Policies > Response headers and create a new policy:

• Name: CSP-Report-Only-Policy
• Custom headers → Add header:

Header name:  Content-Security-Policy-Report-Only
Header value: default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; report-uri https://cspwarden.com/api/v1/csp-report/YOUR-DOMAIN-TOKEN/; report-to csp-endpoint
Override origin: Yes

# Add a second custom header for the companion Reporting-Endpoints:
Header name:  Reporting-Endpoints
Header value: csp-endpoint="https://cspwarden.com/api/v1/csp-report/YOUR-DOMAIN-TOKEN/"
Override origin: Yes

Add both headers: report-to names a reporting group (csp-endpoint), and the Reporting-Endpoints header maps that name to the actual HTTPS URL. Type the value into the header field exactly as shown - the quotes are taken literally. The legacy report-uri keeps older browsers working.

Go to your CloudFront distribution, select the Behaviors tab, edit the relevant cache behavior, and set the Response headers policy to the policy you just created.

For more control, use a CloudFront Function attached to the viewer response event:

function handler(event) {
  var response = event.response;
  var headers = response.headers;

  headers['content-security-policy-report-only'] = {
    value: "default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; report-uri https://cspwarden.com/api/v1/csp-report/YOUR-DOMAIN-TOKEN/; report-to csp-endpoint"
  };
  // Companion header: maps the "csp-endpoint" group named by report-to to your report URL
  headers['reporting-endpoints'] = {
    value: 'csp-endpoint="https://cspwarden.com/api/v1/csp-report/YOUR-DOMAIN-TOKEN/"'
  };

  return response;
}

Associate the function with your distribution's cache behavior under Function associations > Viewer response.

After reviewing violations in your CSP Warden dashboard, update the header name from Content-Security-Policy-Report-Only to Content-Security-Policy in your Response Headers Policy or CloudFront Function.

Create an invalidation to ensure the new header is served immediately:

aws cloudfront create-invalidation \
  --distribution-id YOUR_DISTRIBUTION_ID \
  --paths "/*"

• Header not appearing: Ensure Override origin is enabled in the Response Headers Policy so CloudFront doesn't defer to the origin's headers.
• Cached responses missing header: Create a cache invalidation for /* after attaching the policy. New requests will pick up the header.
• Function errors: Check the CloudFront Function metrics in the AWS Console. Ensure the function returns the response object correctly.
• Reports not received: Verify the report-uri URL is correct and that CloudFront is not stripping it. Test with curl -I yourdomain.com.