You are viewing a plain text version of this content. The canonical link for it is here.
Posted to dev@tomcat.apache.org by bu...@apache.org on 2016/01/12 08:48:09 UTC
[Bug 58837] New: support "X-Content-Security-Policy" a.k.a as "CSP"
https://bz.apache.org/bugzilla/show_bug.cgi?id=58837
Bug ID: 58837
Summary: support "X-Content-Security-Policy" a.k.a as "CSP"
Product: Tomcat 8
Version: trunk
Hardware: PC
OS: Windows NT
Status: NEW
Severity: enhancement
Priority: P2
Component: Connectors
Assignee: dev@tomcat.apache.org
Reporter: hauser@acm.org
see also https://www.owasp.org/index.php/Content_Security_Policy
- http://w3c.github.io/webappsec-csp/
- http://www.html5rocks.com/en/tutorials/security/content-security-policy/
--
You are receiving this mail because:
You are the assignee for the bug.
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@tomcat.apache.org
For additional commands, e-mail: dev-help@tomcat.apache.org
[Bug 58837] support "X-Content-Security-Policy" a.k.a as "CSP"
Posted by bu...@apache.org.
https://bz.apache.org/bugzilla/show_bug.cgi?id=58837
Christopher Schultz <ch...@christopherschultz.net> changed:
What |Removed |Added
----------------------------------------------------------------------------
Component|Connectors |Catalina
--- Comment #5 from Christopher Schultz <ch...@christopherschultz.net> ---
I don't think this is for "Connectors" [mod_jk]. Re-assigning component.
--
You are receiving this mail because:
You are the assignee for the bug.
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@tomcat.apache.org
For additional commands, e-mail: dev-help@tomcat.apache.org
[Bug 58837] support "X-Content-Security-Policy" a.k.a as "CSP"
Posted by bu...@apache.org.
https://bz.apache.org/bugzilla/show_bug.cgi?id=58837
--- Comment #7 from Donald <dk...@gmail.com> ---
I am often missing a generic filter where you just can provide a header name
and value. If this is added then CSP is also supported. Any reason why such a
filter does not exist yet?
--
You are receiving this mail because:
You are the assignee for the bug.
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@tomcat.apache.org
For additional commands, e-mail: dev-help@tomcat.apache.org
[Bug 58837] support "X-Content-Security-Policy" a.k.a as "CSP"
Posted by bu...@apache.org.
https://bz.apache.org/bugzilla/show_bug.cgi?id=58837
Mark Thomas <ma...@apache.org> changed:
What |Removed |Added
----------------------------------------------------------------------------
Status|NEW |RESOLVED
Resolution|--- |DUPLICATE
--- Comment #9 from Mark Thomas <ma...@apache.org> ---
The mod_headers like component has had some interest lately. The new issue has
more up to date info.
*** This bug has been marked as a duplicate of bug 65267 ***
--
You are receiving this mail because:
You are the assignee for the bug.
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@tomcat.apache.org
For additional commands, e-mail: dev-help@tomcat.apache.org
[Bug 58837] support "X-Content-Security-Policy" a.k.a as "CSP"
Posted by bu...@apache.org.
https://bz.apache.org/bugzilla/show_bug.cgi?id=58837
--- Comment #8 from Christopher Schultz <ch...@christopherschultz.net> ---
My own personal concern is that we don't want to end up re-implementing this:
http://tuckey.org/urlrewrite/ or this:
https://tomcat.apache.org/tomcat-9.0-doc/rewrite.html
It wouldn't be a bad thing to have something like this:
https://httpd.apache.org/docs/current/mod/mod_headers.html
Feel free to start small and only support unconditionally adding response
headers.
--
You are receiving this mail because:
You are the assignee for the bug.
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@tomcat.apache.org
For additional commands, e-mail: dev-help@tomcat.apache.org
[Bug 58837] support "X-Content-Security-Policy" a.k.a as "CSP"
Posted by bu...@apache.org.
https://bz.apache.org/bugzilla/show_bug.cgi?id=58837
--- Comment #3 from Ralf Hauser <ha...@acm.org> ---
https://www.owasp.org/index.php/OWASP_Secure_Headers_Project#csp
--
You are receiving this mail because:
You are the assignee for the bug.
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@tomcat.apache.org
For additional commands, e-mail: dev-help@tomcat.apache.org
[Bug 58837] support "X-Content-Security-Policy" a.k.a as "CSP"
Posted by bu...@apache.org.
https://bz.apache.org/bugzilla/show_bug.cgi?id=58837
Christopher Schultz <ch...@christopherschultz.net> changed:
What |Removed |Added
----------------------------------------------------------------------------
Keywords| |Beginner
--- Comment #4 from Christopher Schultz <ch...@christopherschultz.net> ---
Ralph, would you care to propose a patch?
--
You are receiving this mail because:
You are the assignee for the bug.
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@tomcat.apache.org
For additional commands, e-mail: dev-help@tomcat.apache.org
[Bug 58837] support "X-Content-Security-Policy" a.k.a as "CSP"
Posted by bu...@apache.org.
https://bz.apache.org/bugzilla/show_bug.cgi?id=58837
--- Comment #2 from Ralf Hauser <ha...@acm.org> ---
maybe the HttpHeaderSecurityFilter.java of bug 58735 can be used for this
see also bug 58548
--
You are receiving this mail because:
You are the assignee for the bug.
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@tomcat.apache.org
For additional commands, e-mail: dev-help@tomcat.apache.org
[Bug 58837] support "X-Content-Security-Policy" a.k.a as "CSP"
Posted by bu...@apache.org.
https://bz.apache.org/bugzilla/show_bug.cgi?id=58837
--- Comment #1 from Mark Thomas <ma...@apache.org> ---
This looks sufficiently complex that a dedicated filter is required.
What isn't clear at this point is if a useful generic filter can be written (in
which case it could be added to Tomcat's standard set of filters) or if user
really needs to write there own.
--
You are receiving this mail because:
You are the assignee for the bug.
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@tomcat.apache.org
For additional commands, e-mail: dev-help@tomcat.apache.org
[Bug 58837] support "X-Content-Security-Policy" a.k.a as "CSP"
Posted by bu...@apache.org.
https://bz.apache.org/bugzilla/show_bug.cgi?id=58837
--- Comment #6 from Igal Sapir <de...@21solutions.net> ---
Chris,
I can submit a patch if given some guidelines about the Filter's configuration
specs.
Perhaps a very general-purpose Filter should be written -- one that takes
header names and values and sends them if the mapping is matched.
Then such a Filter can be extended to a more specific implementation for CSP or
other applications.
Igal
--
You are receiving this mail because:
You are the assignee for the bug.
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@tomcat.apache.org
For additional commands, e-mail: dev-help@tomcat.apache.org