You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@wicket.apache.org by "Martin Grigorov (JIRA)" <ji...@apache.org> on 2013/11/15 16:03:25 UTC
[jira] [Updated] (WICKET-5406) Better Content Security Policy
Support
[ https://issues.apache.org/jira/browse/WICKET-5406?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]
Martin Grigorov updated WICKET-5406:
------------------------------------
Priority: Minor (was: Major)
> Better Content Security Policy Support
> --------------------------------------
>
> Key: WICKET-5406
> URL: https://issues.apache.org/jira/browse/WICKET-5406
> Project: Wicket
> Issue Type: Improvement
> Components: wicket
> Reporter: Mario Groß
> Priority: Minor
> Labels: CSP, Content-Security-Policy, Cross-site-Scripting, Security
>
> A better support of the Content Security Policy (http://en.wikipedia.org/wiki/Content_Security_Policy) would protect against cross-site scripting attacks and improve the security image of wicket.
> The main problem at the moment is the heavily used inline javascript code which interferes with the whitelisting mechanism of script sources in the CSP and should be avoided .
--
This message was sent by Atlassian JIRA
(v6.1#6144)