title: Set multiple headers conditionally with rewrite rules [apache httpd.conf]
body: <p>I've been trying to set headers conditionally with few RewriteCond. Doesn't quite seem to work.</p>
  
  <pre><code>&lt;IfModule mod_rewrite.c&gt;
    RewriteEngine on
    RewriteLog "/tmp/rewrite.log"
    RewriteLogLevel 9
  
    RewriteCond %{HTTP_REFERER} "/id\:no\:"
    RewriteCond %{REQUEST_URI} "/live-stream/"
  
    RewriteRule ^.*$ - [ENV=stream:true]
    Header unset X-Frame-Options env=stream
    Header set Content-Security-Policy "frame-ancestors ‘self’ *.google.com:443 *.mydomain.com:443 mydomain2.com:443;” env=stream
  &lt;/IfModule&gt; 
  </code></pre>
  
  <p>Both the conditions match, but the rewrite rule does not seem to show the results, when curled. It is taking the common settings set for other uri's.</p>
  
  <p><strong>Update1:</strong>
  I have got the unset string header to work.</p>
  
  <pre><code>&lt;IfModule mod_rewrite.c&gt;
    RewriteEngine on
    RewriteLog "/tmp/rewrite.log"
    RewriteLogLevel 9
  
    RewriteCond %{HTTP_REFERER} "/id\:no\:"
    RewriteCond %{REQUEST_URI} "/live-stream/"
    RewriteRule ^ - [ENV=stream1:true]
  
    RewriteCond %{HTTP_REFERER} "/id\:no\:"
    RewriteCond %{REQUEST_URI} "/live-stream/"
    RewriteRule ^ - [ENV=stream2:true]
  
    Header set Content-Security-Policy "frame-ancestors ‘self’ *.google.com:443 *.mydomain.com:443 mydomain2.com:443;” env=stream2
  &lt;/IfModule&gt;
  </code></pre>
  
  <p>I have managed to unset the header by using the Env variable at rewrite rule and negated at the level where it was setting it.</p>
  
  <p>The only thing that doesn't work now is the <strong>Content-Security-Policy</strong> changes. </p>
  
  <p>This is the output I get:
  $ curl -H 'Referer: <a href="https://www.example.net/buy/id:no:1234567" rel="nofollow noreferrer">https://www.example.net/buy/id:no:1234567</a>' 'www.example.net/applications/buy/live-stream/list/en-us/ind‌​ex.html' -sS -o /dev/null -D -</p>
  
  <pre><code>HTTP/1.1 200 OK
  Date: Tue, 19 Dec 2017 00:31:14 GMT
  Content-Security-Policy: frame-ancestors 'self' *.google.com:443 *.mydomain.com:443 mydomain2.com:443;” env=stream2
  </code></pre>