Traefik

Traefik CSP Setup Guide

Prerequisites

Traefik 2.x or later
Access to your Traefik static and dynamic configuration
A CSP Warden account with a verified domain
Your domain reporting token (found in your CSP Warden dashboard)

Create a Headers Middleware (Report-Only Mode)

Define a middleware in your Traefik dynamic configuration that sets the Content-Security-Policy-Report-Only header. Using a YAML file:

yaml

# dynamic-config.yml
http:
  middlewares:
    csp-report-only:
      headers:
        customResponseHeaders:
          Content-Security-Policy-Report-Only: "default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; report-uri https://cspwarden.com/api/v1/csp-report/YOUR-DOMAIN-TOKEN/; report-to csp-endpoint"
          # Companion header: maps the "csp-endpoint" group named by report-to to your report URL
          Reporting-Endpoints: 'csp-endpoint="https://cspwarden.com/api/v1/csp-report/YOUR-DOMAIN-TOKEN/"'

Ship both headers together: report-to names a reporting group (csp-endpoint), and the Reporting-Endpoints header maps that name to the actual HTTPS URL. The legacy report-uri keeps older browsers working.

Or using TOML:

toml

# dynamic-config.toml
[http.middlewares.csp-report-only.headers]
  [http.middlewares.csp-report-only.headers.customResponseHeaders]
    Content-Security-Policy-Report-Only = "default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; report-uri https://cspwarden.com/api/v1/csp-report/YOUR-DOMAIN-TOKEN/; report-to csp-endpoint"
    Reporting-Endpoints = 'csp-endpoint="https://cspwarden.com/api/v1/csp-report/YOUR-DOMAIN-TOKEN/"'

Attach Middleware to Your Router

Apply the middleware to your router so the header is added to all responses:

yaml

http:
  routers:
    my-router:
      rule: "Host(`yourdomain.com`)"
      entryPoints:
        - websecure
      middlewares:
        - csp-report-only
      service: my-service
      tls:
        certResolver: letsencrypt

Docker Labels (Alternative)

If you manage Traefik with Docker Compose, you can configure the middleware directly via labels:

yaml

# docker-compose.yml
services:
  my-app:
    image: my-app:latest
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.my-app.rule=Host(`yourdomain.com`)"
      - "traefik.http.routers.my-app.entrypoints=websecure"
      - "traefik.http.routers.my-app.tls.certresolver=letsencrypt"
      - "traefik.http.routers.my-app.middlewares=csp-headers"
      - "traefik.http.middlewares.csp-headers.headers.customresponseheaders.Content-Security-Policy-Report-Only=default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; report-uri https://cspwarden.com/api/v1/csp-report/YOUR-DOMAIN-TOKEN/; report-to csp-endpoint"
      - 'traefik.http.middlewares.csp-headers.headers.customresponseheaders.Reporting-Endpoints=csp-endpoint="https://cspwarden.com/api/v1/csp-report/YOUR-DOMAIN-TOKEN/"'

Switch to Enforcement Mode

After reviewing violations in your CSP Warden dashboard, replace Content-Security-Policy-Report-Only with Content-Security-Policy in your middleware definition:

yaml

http:
  middlewares:
    csp-enforce:
      headers:
        customResponseHeaders:
          Content-Security-Policy: "default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; report-uri https://cspwarden.com/api/v1/csp-report/YOUR-DOMAIN-TOKEN/; report-to csp-endpoint"
          Reporting-Endpoints: 'csp-endpoint="https://cspwarden.com/api/v1/csp-report/YOUR-DOMAIN-TOKEN/"'

Troubleshooting

Header not appearing: Verify the middleware is attached to your router and that the dynamic configuration file is being loaded by Traefik.
Middleware not loading: Check Traefik's dashboard or logs for configuration errors. Ensure the providers.file.filename points to your dynamic config.
Docker labels ignored: Ensure traefik.enable=true is set and the container is on the same Docker network as Traefik.

# dynamic-config.yml http: middlewares: csp-report-only: headers: customResponseHeaders: Content-Security-Policy-Report-Only: "default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; report-uri https://cspwarden.com/api/v1/csp-report/YOUR-DOMAIN-TOKEN/; report-to csp-endpoint" # Companion header: maps the "csp-endpoint" group named by report-to to your report URL Reporting-Endpoints: 'csp-endpoint="https://cspwarden.com/api/v1/csp-report/YOUR-DOMAIN-TOKEN/"'

# dynamic-config.toml [http.middlewares.csp-report-only.headers] [http.middlewares.csp-report-only.headers.customResponseHeaders] Content-Security-Policy-Report-Only = "default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; report-uri https://cspwarden.com/api/v1/csp-report/YOUR-DOMAIN-TOKEN/; report-to csp-endpoint" Reporting-Endpoints = 'csp-endpoint="https://cspwarden.com/api/v1/csp-report/YOUR-DOMAIN-TOKEN/"'

http: routers: my-router: rule: "Host(`yourdomain.com`)" entryPoints: - websecure middlewares: - csp-report-only service: my-service tls: certResolver: letsencrypt

# docker-compose.yml services: my-app: image: my-app:latest labels: - "traefik.enable=true" - "traefik.http.routers.my-app.rule=Host(`yourdomain.com`)" - "traefik.http.routers.my-app.entrypoints=websecure" - "traefik.http.routers.my-app.tls.certresolver=letsencrypt" - "traefik.http.routers.my-app.middlewares=csp-headers" - "traefik.http.middlewares.csp-headers.headers.customresponseheaders.Content-Security-Policy-Report-Only=default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; report-uri https://cspwarden.com/api/v1/csp-report/YOUR-DOMAIN-TOKEN/; report-to csp-endpoint" - 'traefik.http.middlewares.csp-headers.headers.customresponseheaders.Reporting-Endpoints=csp-endpoint="https://cspwarden.com/api/v1/csp-report/YOUR-DOMAIN-TOKEN/"'

http: middlewares: csp-enforce: headers: customResponseHeaders: Content-Security-Policy: "default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; report-uri https://cspwarden.com/api/v1/csp-report/YOUR-DOMAIN-TOKEN/; report-to csp-endpoint" Reporting-Endpoints: 'csp-endpoint="https://cspwarden.com/api/v1/csp-report/YOUR-DOMAIN-TOKEN/"'

Troubleshooting

Header not appearing: Verify the middleware is attached to your router and that the dynamic configuration file is being loaded by Traefik.
Middleware not loading: Check Traefik's dashboard or logs for configuration errors. Ensure the providers.file.filename points to your dynamic config.
Docker labels ignored: Ensure traefik.enable=true is set and the container is on the same Docker network as Traefik.