[jira] [Commented] (WICKET-7006) Configure CSP directives per Page

["Ernesto Reinaldo Barreiro (Jira)" <ji...@apache.org>]

    [ https://issues.apache.org/jira/browse/WICKET-7006?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=17845351#comment-17845351 ] 

Ernesto Reinaldo Barreiro commented on WICKET-7006:
---------------------------------------------------

I fully agree with [~mgrigorov] wicket mailing list should be the place to ask questions. Anyways... there is some similar idea, already reported.

 

https://issues.apache.org/jira/browse/WICKET-7040

 

What you describe should be easy to integrate into ISSUE above (maybe).

> Configure CSP directives per Page
> ---------------------------------
>
>                 Key: WICKET-7006
>                 URL: https://issues.apache.org/jira/browse/WICKET-7006
>             Project: Wicket
>          Issue Type: Improvement
>          Components: wicket-core
>            Reporter: Dirk Forchel
>            Priority: Major
>
> Each Wicket component should be able to add/remove its own CSP (Content-Security-Policy) rules to the Page and their Response header currently rendered.
> Following the description in [https://nightlies.apache.org/wicket/guide/9.x/single.html#_content_security_policy_csp] all CSP rules are managed via Application settings (class ContentSecurityPolicySettings). 
> Currently you are able to add/remove key-value-pairs to the CSP header configuration for a specific Component (or even Behavior class) at any time, e.g.
> {code:java}
> WebApplication.get().getCspSettings().getConfiguration().get(...).add(key, value)
> {code}
> or
> {code:java}
> WebApplication.get().getCspSettings().getConfiguration().get(...).remove(key, value)
> {code}
> But as developer I would expect a more sophisticated way with some hook methods, e.g.
> {code:java}
> public void addCSPDirectives(final CSPHeaderConfiguration configuration)
> { 
>    blocking.add(CSPDirective.SCRIPT_SRC, new FixedCSPValue("www.foo.com"));
>    blocking.add(CSPDirective.STYLE_SRC, UNSAFE_INLINE);
> };
> {code}
> where each of these directives are rendered into the response header without caring how this is done. Each of these directives shoud only be rendered when the component is visible. After the rendering process, the added directives are automatically removed from the map (ContentSecurityPolicySettings#configs).



--
This message was sent by Atlassian Jira
(v8.20.10#820010)