Apache2 SSL Mixed content blocked

[tonysar]

Hello.
I am running Apache 2 as reverse proxy for Dotnet . after small configuration , everything works fine.
installed Let's Encrypt SSL , I can access site thought HTTPS however, some scripts are being blocked as Mixed content .
Previous to Apache , I was running Nginx to solve this content blocking issue , added following to configuration file.

Code: Select all

add_header 'Content-Security-Policy' 'upgrade-insecure-requests';


and solve the mixed content blocking issue.
with Apache , I have no idea how to solve this .
I really appreciate any info.

Here is vhost configuration.

Code: Select all


<VirtualHost *.*>
RequestHeader set "X-Forwarded-Proto" expr=%{REQUEST_SCHEME}
</VirtualHost>

<VirtualHost *:80>

   ServerAdmin admin@MYDOMAIN.ca
   DocumentRoot /var/www/solution/html
   ProxyPreserveHost On
        ProxyPass / http://127.0.0.1:5000/
        ProxyPassReverse / http://127.0.0.1:5000/
        ServerName MYDOMAIN.ca
        ServerAlias www.MYDOMAIN.ca

   # Available loglevels: trace8, ..., trace1, debug, info, notice, warn,
   # error, crit, alert, emerg.
   # It is also possible to configure the loglevel for particular
   # modules, e.g.
   #LogLevel info ssl:warn

   ErrorLog ${APACHE_LOG_DIR}/error.log
   CustomLog ${APACHE_LOG_DIR}/access.log combined



RewriteEngine on
RewriteCond %{SERVER_NAME} =www.MYDOMAIN.ca [OR]
RewriteCond %{SERVER_NAME} =MYDOMAIN.ca
RewriteRule ^ https://%{SERVER_NAME}%{REQUEST_URI} [END,NE,R=permanent]
</VirtualHost>



[tonysar]

solve that by adding following to apache security.conf

Code: Select all

Header set Content-Security-Policy "upgrade-insecure-requests;"