# “Missing OWASP secure headers” error in zoom client mac

**URL:** <https://devforum.zoom.us/t/missing-owasp-secure-headers-error-in-zoom-client-mac/104319>\
**Category:** Zoom Apps\
**Created:** [February 21, 2024, 4:33pm UTC](https://devforum.zoom.us/t/missing-owasp-secure-headers-error-in-zoom-client-mac/104319 "2024-02-21T16:33:39Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![TimDave](https://sea2.discourse-cdn.com/flex016/user_avatar/devforum.zoom.us/timdave/32/51391_2.png) [@TimDave](https://devforum.zoom.us/u/TimDave)\
**Post date:** [February 21, 2024, 4:33pm UTC](https://devforum.zoom.us/t/missing-owasp-secure-headers-error-in-zoom-client-mac/104319/1 "2024-02-21T16:33:39Z")

</div>

We are getting this error on Mac client on windows it works fine.

please help us to fix the issue we are using react frontend and Django backend.  
its really urgent 🙂

---

<div class="post-metadata">

**Author:** ![freelancer.nak](https://sea2.discourse-cdn.com/flex016/user_avatar/devforum.zoom.us/freelancer.nak/32/40968_2.png) [@freelancer.nak](https://devforum.zoom.us/u/freelancer.nak)\
**Post date:** [February 21, 2024, 7:32pm UTC](https://devforum.zoom.us/t/missing-owasp-secure-headers-error-in-zoom-client-mac/104319/2 "2024-02-21T19:32:13Z")

</div>

Hi, hope you will be fine.

You need to add OWASP headers e.g below is nextjs config how to add those

```auto

/** @type 
{import('next').NextConfig} */

const ContentSecurityPolicy = `
  script-src 'self' https://appssdk.zoom.us/sdk.js 'unsafe-eval' 'unsafe-inline';
  style-src 'self' ${process.env.ZOOM_REDIRECT_URI} 'unsafe-inline';
  font-src 'self';  
`

const headers = [{
    key: 'Strict-Transport-Security',
    value: 'max-age=63072000; includeSubDomains; preload'
  },
  {
    key: 'Content-Security-Policy',
    value: ContentSecurityPolicy.replace(/\s{2,}/g, ' ').trim()
  }, {
    key: 'X-Content-Type-Options',
    value: 'nosniff'
  }, {
    key: 'Referrer-Policy',
    value: 'same-origin'
  },
  {
    key: 'X-Frame-Options',
    value: 'SAMEORIGIN'
  },
  {
    key: 'frameguard',
    value: 'sameorigin'
  }
];

const nextConfig = {
  compress: true,
  reactStrictMode: false,
  async headers() {
    return [{
      // Apply these headers to all routes in your application.
      source: '/:path*',
      headers: headers,
    }, ]
  },
}
module.exports = nextConfig

```

---

<div class="post-metadata">

**Author:** ![TimDave](https://sea2.discourse-cdn.com/flex016/user_avatar/devforum.zoom.us/timdave/32/51391_2.png) [@TimDave](https://devforum.zoom.us/u/TimDave)\
**Post date:** [February 22, 2024, 4:01am UTC](https://devforum.zoom.us/t/missing-owasp-secure-headers-error-in-zoom-client-mac/104319/3 "2024-02-22T04:01:04Z")

</div>

Hey @freelancer.nak,

thanks for the response, where should i add these header on the server or in my client side react app?

---

<div class="post-metadata">

**Author:** ![TimDave](https://sea2.discourse-cdn.com/flex016/user_avatar/devforum.zoom.us/timdave/32/51391_2.png) [@TimDave](https://devforum.zoom.us/u/TimDave)\
**Post date:** [February 22, 2024, 4:59pm UTC](https://devforum.zoom.us/t/missing-owasp-secure-headers-error-in-zoom-client-mac/104319/4 "2024-02-22T16:59:01Z")

</div>

@MaxM please see this it shows even warning here during creating and when i run in client i get console error it working on windows but not in mac.

 ![image](https://us1.discourse-cdn.com/flex016/uploads/zoomdeveloper/original/3X/d/5/d54644eebc951537f372d564afd9479cc8dcc351.png)

---

<div class="post-metadata">

**Author:** ![MaxM](https://sea2.discourse-cdn.com/flex016/user_avatar/devforum.zoom.us/maxm/32/42303_2.png) [@MaxM](https://devforum.zoom.us/u/MaxM)\
**Post date:** [March 20, 2024, 9:53pm UTC](https://devforum.zoom.us/t/missing-owasp-secure-headers-error-in-zoom-client-mac/104319/5 "2024-03-20T21:53:07Z")

</div>

Apologies for the delay in getting back to you. It sounds like headers may be set conditionally in a way that excludes MacOS and other browsers. Try this from a MacOS browser:

1. Open Dev Console
2. Click Network tab
3. Click webpage
4. Select the header tab
5. Look for OWASP headers

Are you seeing the headers when you check from the dev console of a regular browser? How about when you check from the Zoom App?