# HTTP Security headers for error pages

**URL:** <https://discourse.haproxy.org/t/http-security-headers-for-error-pages/2991>\
**Category:** Help!\
**Created:** [September 13, 2018, 11:27am UTC](https://discourse.haproxy.org/t/http-security-headers-for-error-pages/2991 "2018-09-13T11:27:25Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![Bruno](https://avatars.discourse-cdn.com/v4/letter/b/c77e96/32.png) [@Bruno](https://discourse.haproxy.org/u/Bruno)\
**Post date:** [September 13, 2018, 11:27am UTC](https://discourse.haproxy.org/t/http-security-headers-for-error-pages/2991/1 "2018-09-13T11:27:25Z")

</div>

Hello,

I’ve seen this article: [Neatly bypassing CSP](https://lab.wallarm.com/how-to-trick-csp-in-letting-you-run-whatever-you-want-73cb5ff428aa). And it appears that the error pages served by haproxy can be used to bypass some Content-Security-Policy rules.

It looks like it should be possible to customize the error from haproxy with the [errorfile](https://cbonte.github.io/haproxy-dconv/1.8/configuration.html#errorfile) command, but it’s tedious to do that for each HTTP status code. Is it possible to add an HTTP header for all the error pages served by haproxy without having to edit the error for each status code?

And maybe the haproxy developpers should consider having `X-Frame-Options: DENY` by default for the error pages. I’m not sure, but it looks like a good default.

---

<div class="post-metadata">

**Author:** ![lukastribus](https://avatars.discourse-cdn.com/v4/letter/l/7ea924/32.png) [@lukastribus](https://discourse.haproxy.org/u/lukastribus)\
**Post date:** [September 13, 2018, 2:23pm UTC](https://discourse.haproxy.org/t/http-security-headers-for-error-pages/2991/2 "2018-09-13T14:23:23Z")

</div>

We also have that problem with HSTS and other headers, and it’s not only error pages, http redirects are also affected:

[https://www.mail-archive.com/haproxy@formilux.org/msg25061.html](https://www.mail-archive.com/haproxy@formilux.org/msg25061.html)

[https://www.mail-archive.com/haproxy@formilux.org/msg29294.html](https://www.mail-archive.com/haproxy@formilux.org/msg29294.html)

[https://www.mail-archive.com/haproxy@formilux.org/msg16156.html](https://www.mail-archive.com/haproxy@formilux.org/msg16156.html)

This is something that is still on the todo list.