{"record":{"id":"43b66d391a8eded0","repo":"apache/druid","slug":"content-security-policy-header-value-must-be-fully","errorCode":null,"errorMessage":"Content-Security-Policy header value must be fully ASCII","messagePattern":"Content-Security-Policy header value must be fully ASCII","errorType":"validation","errorClass":"IllegalArgumentException","httpStatus":null,"severity":"error","filePath":"server/src/main/java/org/apache/druid/server/initialization/jetty/StandardResponseHeaderFilterHolder.java","lineNumber":93,"sourceCode":"  {\n    for (final String headerName : StandardResponseHeaderFilterHolder.STANDARD_HEADERS) {\n      if (serverResponse.getHeaders().contains(headerName) && proxyResponse.containsHeader(headerName)) {\n        // In EE8 compatible Jetty 12 using servlet API 4.x, setting a header to null is the accepted way to remove it.\n        proxyResponse.setHeader(headerName, null);\n      }\n    }\n  }\n\n  static String asContentSecurityPolicyHeaderValue(@Nullable final String contentSecurityPolicy)\n  {\n    if (contentSecurityPolicy == null || contentSecurityPolicy.trim().isEmpty()) {\n      return DEFAULT_CONTENT_SECURITY_POLICY;\n    } else {\n      // Header values must be ASCII or RFC 2047 encoded. We don't have an RFC 2047 encoder handy, so require\n      // that the value be plain ASCII.\n      for (int i = 0; i < contentSecurityPolicy.length(); i++) {\n        if (!CharUtils.isAscii(contentSecurityPolicy.charAt(i))) {\n          throw new IAE(\"Content-Security-Policy header value must be fully ASCII\");\n        }\n      }\n\n      return contentSecurityPolicy;\n    }\n  }\n\n  @Override\n  public Filter getFilter()\n  {\n    return new StandardResponseHeaderFilter(contentSecurityPolicy);\n  }\n\n  @Override\n  public Class<? extends Filter> getFilterClass()\n  {\n    return StandardResponseHeaderFilter.class;\n  }","sourceCodeStart":75,"sourceCodeEnd":111,"githubUrl":"https://github.com/apache/druid/blob/9b90983fd291f26935af934383ce360473179e4d/server/src/main/java/org/apache/druid/server/initialization/jetty/StandardResponseHeaderFilterHolder.java#L75-L111","documentation":"Druid lets operators override the Content-Security-Policy response header via configuration. HTTP header values must be plain ASCII (or RFC 2047 encoded, which Druid does not implement), so asContentSecurityPolicyHeaderValue scans each character of the configured value and throws this IllegalArgumentException if any non-ASCII character is found.","triggerScenarios":"Configuring druid.auth... response-header Content-Security-Policy (or the filter's configured value) with non-ASCII characters, e.g. a copy-pasted directive containing a Unicode quote, en-dash, or curly apostrophe.","commonSituations":"Pasting CSP strings from word processors or web pages that replace ASCII characters with typographic Unicode equivalents; accidentally including a BOM or non-breaking space.","solutions":["Retype the configured CSP value ensuring only ASCII characters are used.","Replace Unicode punctuation with ASCII equivalents: curly quotes to ', en-dash to -, non-breaking space to space.","Validate the property file encoding and strip any BOM from config files."],"exampleFix":"// before (config)\ndrui...csp=default-src 'self'; frame-ancestors 'none'–style-src 'self'\n// after\ncsp=default-src 'self'; frame-ancestors 'none'; style-src 'self'","handlingStrategy":"validation","validationCode":"function isAscii(s) {\n  return /^\\x00-\\x7F]*$/.test(s);\n}\nif (!isAscii(config.contentSecurityPolicy)) {\n  throw new Error('Content-Security-Policy value must be fully ASCII');\n}","typeGuard":"function isAsciiHeader(value) {\n  return typeof value === 'string' && [...value].every(c => c.charCodeAt(0) <= 0x7F);\n}","tryCatchPattern":"try {\n  injector.getInstance(Lifecycle.class).start();\n} catch (IllegalArgumentException e) {\n  if (e.getMessage().contains(\"must be fully ASCII\")) {\n    log.fatal(\"Fix configured CSP header value: %s\", e.getMessage());\n  } else { throw e; }\n}","preventionTips":["Type CSP config values in a plain-text editor, never paste from word processors or rich web pages.","Check config files for BOM/non-ASCII bytes (e.g. `grep -P '[^\\x00-\\x7F]'`) before deploy.","Use ASCII quote characters (' or \") and hyphens (-) in header config values."],"tags":["http-headers","security","configuration","validation"],"backgroundTag":"invalid-config-value","analyzedSha":"9b90983fd291f26935af934383ce360473179e4d","analyzedAt":"2026-09-07T13:32:30.957Z","contentChangedAt":"2026-09-07T13:32:30.957Z","schemaVersion":2},"datasetVersion":"2026-09-17T15:17:12.973Z"}