Spring/spring-security
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Adds support for Content Security Policy

Browse Source 
Fixes gh-2342
This commit is contained in:
Joe Grandja
2016-03-17 10:07:40 -04:00
committed by Rob Winch
parent 4cb9b202f8
commit 2f7f2ff589
9 changed files with 675 additions and 17 deletions
Download Patch File Download Diff File Expand all files Collapse all files

12
config/src/main/resources/org/springframework/security/config/spring-security-4.1.rnc
View File

@@ -748,7 +748,7 @@ csrf-options.attlist &=
headers =
## Element for configuration of the HeaderWritersFilter. Enables easy setting for the X-Frame-Options, X-XSS-Protection and X-Content-Type-Options headers.
element headers { headers-options.attlist, (cache-control? & xss-protection? & hsts? & frame-options? & content-type-options? & hpkp? & header*)}
element headers { headers-options.attlist, (cache-control? & xss-protection? & hsts? & frame-options? & content-type-options? & hpkp? & content-security-policy? & header*)}
headers-options.attlist &=
## Specifies if the default headers should be disabled. Default false.
attribute defaults-disabled {xsd:boolean}?
@@ -800,6 +800,16 @@ hpkp.attlist &=
## Specifies the URI to which the browser should report pin validation failures.
attribute report-uri {xsd:string}?
content-security-policy =
## Adds support for Content Security Policy (CSP)
element content-security-policy {csp-options.attlist}
csp-options.attlist &=
## The security policy directive(s) for the Content-Security-Policy header or if report-only is set to true, then the Content-Security-Policy-Report-Only header is used.
attribute policy-directives {xsd:token}?
csp-options.attlist &=
## Set to true, to enable the Content-Security-Policy-Report-Only header for reporting policy violations only. Defaults to false.
attribute report-only {xsd:boolean}?
cache-control =
## Adds Cache-Control no-cache, no-store, must-revalidate, Pragma no-cache, and Expires 0 for every request
element cache-control {cache-control.attlist}

26
config/src/main/resources/org/springframework/security/config/spring-security-4.1.xsd
View File

@@ -2328,6 +2328,7 @@
<xs:element ref="security:frame-options"/>
<xs:element ref="security:content-type-options"/>
<xs:element ref="security:hpkp"/>
<xs:element ref="security:content-security-policy"/>
<xs:element ref="security:header"/>
</xs:choice>
<xs:attributeGroup ref="security:headers-options.attlist"/>
@@ -2460,6 +2461,31 @@
</xs:annotation>
</xs:attribute>
</xs:attributeGroup>
<xs:element name="content-security-policy">
<xs:annotation>
<xs:documentation>Adds support for Content Security Policy (CSP)
</xs:documentation>
</xs:annotation>
<xs:complexType>
<xs:attributeGroup ref="security:csp-options.attlist"/>
</xs:complexType>
</xs:element>
<xs:attributeGroup name="csp-options.attlist">
<xs:attribute name="policy-directives" type="xs:token">
<xs:annotation>
<xs:documentation>The security policy directive(s) for the Content-Security-Policy header or if report-only
is set to true, then the Content-Security-Policy-Report-Only header is used.
</xs:documentation>
</xs:annotation>
</xs:attribute>
<xs:attribute name="report-only" type="xs:boolean">
<xs:annotation>
<xs:documentation>Set to true, to enable the Content-Security-Policy-Report-Only header for reporting policy
violations only. Defaults to false.
</xs:documentation>
</xs:annotation>
</xs:attribute>
</xs:attributeGroup>
<xs:element name="cache-control">
<xs:annotation>
<xs:documentation>Adds Cache-Control no-cache, no-store, must-revalidate, Pragma no-cache, and Expires 0 for