Package org.apache.juneau.http.header

Class ContentSecurityPolicy

java.lang.Object

org.apache.juneau.http.header.HttpHeaderBean

org.apache.juneau.http.header.HttpStringHeader

org.apache.juneau.http.header.ContentSecurityPolicy

All Implemented Interfaces:

HttpHeader

public class ContentSecurityPolicy
extends HttpStringHeader

Represents an HTTP Content-Security-Policy (or Content-Security-Policy-Report-Only) response header.

A Content Security Policy lets a server declare which content sources a browser may load and execute for a page, mitigating cross-site-scripting (XSS) and data-injection attacks. This bean carries an already-rendered policy value; use ContentSecurityPolicy.Builder to assemble the value from typed directives.

Example:

// Build a static policy and emit it as a response header. ContentSecurityPolicy csp = ContentSecurityPolicy.create() .defaultSrc(ContentSecurityPolicy.Builder.SELF) .objectSrc(ContentSecurityPolicy.Builder.NONE) .toHeader(); // => "Content-Security-Policy: default-src 'self'; object-src 'none'"

Because this is an HttpStringHeader, an instance can be added directly to the REST server's defaultResponseHeaders HttpHeaderList (e.g. via a @Bean(name="defaultResponseHeaders") factory method) and is emitted through the normal response-header path.

See Also:

• ContentSecurityPolicy.Builder
• Content Security Policy Level 3 (W3C WD)
• Content Security Policy Level 2 (W3C Rec)

Since:

10.0.0

Nested Class Summary

Nested Classes

Modifier and Type	Class	Description
static class	ContentSecurityPolicy.Builder	Fluent builder for assembling a Content-Security-Policy header value.

Field Summary

Fields

Modifier and Type	Field	Description
static final String	NAME	The enforcing header name: "Content-Security-Policy".
static final String	REPORT_ONLY_NAME	The observe-only header name: "Content-Security-Policy-Report-Only".

Constructor Summary

Constructors

Modifier	Constructor	Description
	ContentSecurityPolicy(String value)	Constructor with an eager value (enforcing "Content-Security-Policy" header).
protected	ContentSecurityPolicy(String name, String value)	Constructor allowing the header name to be chosen (enforcing vs. report-only).
protected	ContentSecurityPolicy(String name, Supplier<String> valueSupplier)	Constructor allowing the header name to be chosen, with a lazy value supplier.
	ContentSecurityPolicy(Supplier<String> valueSupplier)	Constructor with a lazy value supplier (enforcing "Content-Security-Policy" header).

Method Summary

Modifier and Type	Method	Description
static ContentSecurityPolicy.Builder	create()	Creates a new empty ContentSecurityPolicy.Builder.
static ContentSecurityPolicy	of(String value)	Static factory method for an enforcing ("Content-Security-Policy") header with an eager value.
static ContentSecurityPolicy	of(Supplier<String> valueSupplier)	Static factory method for an enforcing ("Content-Security-Policy") header with a lazy value supplier.
static ContentSecurityPolicy	ofReportOnly(String value)	Static factory method for an observe-only ("Content-Security-Policy-Report-Only") header with an eager value.
static ContentSecurityPolicy	ofReportOnly(Supplier<String> valueSupplier)	Static factory method for an observe-only ("Content-Security-Policy-Report-Only") header with a lazy value supplier.
static ContentSecurityPolicy.Builder	strictStarter()	Creates a ContentSecurityPolicy.Builder pre-populated with the nonce-based strict starter preset.

Methods inherited from class org.apache.juneau.http.header.HttpStringHeader

of, of, ofPair

Methods inherited from class org.apache.juneau.http.header.HttpHeaderBean

equals, equalsIgnoreCase, getName, getValue, hashCode, toString

Methods inherited from class java.lang.Object

clone, finalize, getClass, notify, notifyAll, wait, wait, wait

Field Details

NAME

public static final String NAME

The enforcing header name: "Content-Security-Policy".

See Also:

• Constant Field Values

REPORT_ONLY_NAME

public static final String REPORT_ONLY_NAME

The observe-only header name: "Content-Security-Policy-Report-Only".

See Also:

• Constant Field Values

Constructor Details

ContentSecurityPolicy

public ContentSecurityPolicy(String value)

Constructor with an eager value (enforcing "Content-Security-Policy" header).

Parameters:

value - The header value. May be null.

ContentSecurityPolicy

public ContentSecurityPolicy(Supplier<String> valueSupplier)

Constructor with a lazy value supplier (enforcing "Content-Security-Policy" header).

Parameters:

valueSupplier - Supplier for the header value. Must not be null.

ContentSecurityPolicy

protected ContentSecurityPolicy(String name,
 String value)

Constructor allowing the header name to be chosen (enforcing vs. report-only).

Parameters:

name - The header name. Must not be null.

value - The header value. May be null.

ContentSecurityPolicy

protected ContentSecurityPolicy(String name,
 Supplier<String> valueSupplier)

Constructor allowing the header name to be chosen, with a lazy value supplier.

Parameters:

name - The header name. Must not be null.

valueSupplier - Supplier for the header value. Must not be null.

Method Details

of

public static ContentSecurityPolicy of(String value)

Static factory method for an enforcing ("Content-Security-Policy") header with an eager value.

Parameters:

value - The header value. May be null.

Returns:

A new instance. Never null.

of

public static ContentSecurityPolicy of(Supplier<String> valueSupplier)

Static factory method for an enforcing ("Content-Security-Policy") header with a lazy value supplier.

Parameters:

valueSupplier - Supplier for the header value. Must not be null.

Returns:

A new instance. Never null.

ofReportOnly

public static ContentSecurityPolicy ofReportOnly(String value)

Static factory method for an observe-only ("Content-Security-Policy-Report-Only") header with an eager value.

Browsers report violations against this header but do not block anything, letting operators tune a policy before enforcing it.

Parameters:

value - The header value. May be null.

Returns:

A new instance. Never null.

ofReportOnly

public static ContentSecurityPolicy ofReportOnly(Supplier<String> valueSupplier)

Static factory method for an observe-only ("Content-Security-Policy-Report-Only") header with a lazy value supplier.

Parameters:

valueSupplier - Supplier for the header value. Must not be null.

Returns:

A new instance. Never null.

create

public static ContentSecurityPolicy.Builder create()

Creates a new empty ContentSecurityPolicy.Builder.

Returns:

A new builder. Never null.

strictStarter

public static ContentSecurityPolicy.Builder strictStarter()

Creates a ContentSecurityPolicy.Builder pre-populated with the nonce-based strict starter preset.

Returns:

A new builder pre-populated with the strict-starter directives. Never null.

See Also:

• ContentSecurityPolicy.Builder.strictStarter()