spring-security-config/org.springframework.security.config.web.server/ServerContentSecurityPolicyDsl

ServerContentSecurityPolicyDsl

class ServerContentSecurityPolicyDsl

A Kotlin DSL to configure the ServerHttpSecurity Content-Security-Policy header using idiomatic Kotlin code.

Author

Eleftheria Stein

Ziqin Wang

Since

5.4

Constructors

ServerContentSecurityPolicyDsl

constructor()

Properties

exchangeMatcher

var exchangeMatcher: ServerWebExchangeMatcher?

The ServerWebExchangeMatcher to use for determining when CSP should be applied. The default is to enable CSP in every response if ServerHeadersDsl.contentSecurityPolicy is configured.

nonceAttributeName

var nonceAttributeName: String?

The name of the request attribute for the generated nonce. Views can read this attribute to render the nonce in HTML.

policyDirectives

var policyDirectives: String?

The security policy directive(s) to be used in the response header. The policyDirectives may contain {nonce} as placeholders for a generated secure random nonce, e.g., script-src 'self' 'nonce-{nonce}'.

reportOnly

var reportOnly: Boolean?

Includes the Content-Security-Policy-Report-Only header in the response.

Functions

exchangeMatchers

fun exchangeMatchers(vararg pathPatterns: String)

Specify the matching path patterns for determining when CSP should be applied. The default is to enable CSP in every response if ServerHeadersDsl.contentSecurityPolicy is configured.