Set multiple headers conditionally with rewrite rules [apache httpd.conf]

Question

I've been trying to set headers conditionally with few RewriteCond. Doesn't quite seem to work.

<IfModule mod_rewrite.c>
  RewriteEngine on
  RewriteLog "/tmp/rewrite.log"
  RewriteLogLevel 9

  RewriteCond %{HTTP_REFERER} "/id\:no\:"
  RewriteCond %{REQUEST_URI} "/live-stream/"

  RewriteRule ^.*$ - [ENV=stream:true]
  Header unset X-Frame-Options env=stream
  Header set Content-Security-Policy "frame-ancestors ‘self’ *.google.com:443 *.mydomain.com:443 mydomain2.com:443;” env=stream
</IfModule> 

Both the conditions match, but the rewrite rule does not seem to show the results, when curled. It is taking the common settings set for other uri's.

Update1: I have got the unset string header to work.

<IfModule mod_rewrite.c>
  RewriteEngine on
  RewriteLog "/tmp/rewrite.log"
  RewriteLogLevel 9

  RewriteCond %{HTTP_REFERER} "/id\:no\:"
  RewriteCond %{REQUEST_URI} "/live-stream/"
  RewriteRule ^ - [ENV=stream1:true]

  RewriteCond %{HTTP_REFERER} "/id\:no\:"
  RewriteCond %{REQUEST_URI} "/live-stream/"
  RewriteRule ^ - [ENV=stream2:true]

  Header set Content-Security-Policy "frame-ancestors ‘self’ *.google.com:443 *.mydomain.com:443 mydomain2.com:443;” env=stream2
</IfModule>

I have managed to unset the header by using the Env variable at rewrite rule and negated at the level where it was setting it.

The only thing that doesn't work now is the Content-Security-Policy changes.

This is the output I get: $ curl -H 'Referer: https://www.example.net/buy/id:no:1234567' 'www.example.net/applications/buy/live-stream/list/en-us/ind‌​ex.html' -sS -o /dev/null -D -

HTTP/1.1 200 OK
Date: Tue, 19 Dec 2017 00:31:14 GMT
Content-Security-Policy: frame-ancestors 'self' *.google.com:443 *.mydomain.com:443 mydomain2.com:443;” env=stream2

Answer 1

Try this code as this works for me:

RewriteCond %{HTTP_REFERER} "/id:no:" [NC]
RewriteCond %{REQUEST_URI} "/live-stream/" [NC]
RewriteRule ^ - [E=stream1:1,E=stream2:1]

Header set Content-Security-Policy "frame-ancestors ‘self’ *.google.com:443 *.mydomain.com:443 mydomain2.com:443;" env=stream2

Make sure you don't get any 404 while running your curl command.

Try with this curl command:

curl -IkL -H 'Referer: http://localhost/buy/id:no:1234567' 'localhost/applications/buy/live-stream/list/en-us/index.html'