spring-security-config/org.springframework.security.config.annotation.web.headers/ContentSecurityPolicyDsl

ContentSecurityPolicyDsl

class ContentSecurityPolicyDsl

A Kotlin DSL to configure the HttpSecurity Content-Security-Policy header using idiomatic Kotlin code.

Author

Eleftheria Stein

Ziqin Wang

Since

5.3

Constructors

ContentSecurityPolicyDsl

constructor()

Properties

nonceAttributeName

var nonceAttributeName: String?

The name of the servlet request attribute for the generated nonce. Views can read this attribute to render the nonce in HTML.

policyDirectives

var policyDirectives: String?

The security policy directive(s) to be used in the response header. The policyDirectives may contain {nonce} as placeholders for a generated secure random nonce, e.g., script-src 'self' 'nonce-{nonce}'.

reportOnly

var reportOnly: Boolean?

Includes the Content-Security-Policy-Report-Only header in the response.

requestMatcher

var requestMatcher: RequestMatcher?

The RequestMatcher to use for determining when CSP should be applied. The default is to enable CSP in every response if org.springframework.security.config.annotation.web.HeadersDsl.contentSecurityPolicy is configured.

Functions

requestMatchers

fun requestMatchers(vararg pathPatterns: String)

Specify the matching path patterns for determining when CSP should be applied. The default is to write CSP header in every response if org.springframework.security.config.annotation.web.HeadersDsl.contentSecurityPolicy is configured.