[GitHub] [wicket] svenmeier commented on a change in pull request #382: WICKET-6688 add RFC and replace eval with DOM eval

[GitBox <gi...@apache.org>]

svenmeier commented on a change in pull request #382: WICKET-6688 add RFC and replace eval with DOM eval
URL: https://github.com/apache/wicket/pull/382#discussion_r323780930
 
 

 ##########
 File path: wicket-examples/src/main/java/org/apache/wicket/examples/csp/CspApplication.java
 ##########
 @@ -45,9 +51,22 @@ protected void init()
 	{
 		super.init();
 
-		setHeaderResponseDecorator(response -> new ResourceAggregator(new CspNonceHeaderResponse(response, getNonce())));
+		// Decorate all header items with nonce
+		setHeaderResponseDecorator(response -> new ResourceAggregator(
+				isCspApplicable() ? new CspNonceHeaderResponse(response, getNonce()) : response
+		));
+		// add nonce to ajax response
+		getAjaxRequestTargetListeners().add((new AjaxRequestTarget.IListener()
+		{
+			@Override
+			public void onBeforeRespond(Map<String, Component> map, AjaxRequestTarget target)
+			{
+				target.addMeta("nonce", getNonce());
 
 Review comment:
   The nonce already has to be in the DOM, why not take it from there? I see you've added "meta-csp" already, but I don't find any usage of that.

----------------------------------------------------------------
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
 
For queries about this service, please contact Infrastructure at:
users@infra.apache.org


With regards,
Apache Git Services