Content Security Policy Interceptor
Description
Interceptor that implements Content Security Policy on incoming requests.
Content Security Policy (CSP) is an added layer of security that helps to detect and mitigate certain types of attacks, including Cross-Site Scripting (XSS) and data injection attacks. These attacks are used for everything from data theft, to site defacement, to malware distribution.
CSP can work in two modes, either enforce or report. In the report mode the Content-Security-Policy-Report-Only
header is sent and Content-Security-Policy header is used when using the enforce mode.
CSP is now supported by all major browsers. More information about CSP.
The interceptor adds a nonce value automatically to <s:script> and <s:link> tags. This provides a painless way to
implement CSP in a highly secure fashion.
Parameters
enforcingMode(defaultfalse) - When set to “true”, the enforce mode has been enabled, and the provided policy is going to be enforced.reportUri- an uri under which the violations will be reported.prependServletContext(defaulttrue) - a flag to prepend or not the Servlet context to thereportUri(since Struts 6.4.0).cspSettingsClassName(default toDefaultCspSettings.class) - a full class name implementingCspSettingsinterface to allow to define a custom CPS settings. It’s alternative approach of using the CspSettingsAware interface below (since Struts 6.5.0).
Nonce source
The interceptor generates a fresh nonce on every request and has to keep it somewhere the tags can read it back from when the page renders. By default that is the HTTP session, which means CSP headers are only added once a session exists. Since Struts 6.8.0 the nonce can be kept in a request attribute instead, which suits stateless or clustered deployments that do not want a session created for it:
<constant name="struts.csp.nonce.source" value="request"/>
Accepted values are session (the default) and request.
Note: releases before 7.4.0 shipped
default.propertieswith this setting under the namestruts.csp.nonceSource, which the framework never read — configuring it had no effect and the nonce always stayed in the session. Since 7.4.0 that name is honoured as well, so a configuration carryingstruts.csp.nonceSource=requestswitches to request-scoped nonces on upgrade. The camel-case name is deprecated and logs a warning; rename it tostruts.csp.nonce.source.
Report action
To receive reports about violations against CSP an abstract CspReportAction action has been created, which you can
extend to process the reports. When extending the action you must implement processReport(String) to process the report.
Read JavaDoc of the action for more details.
Note: the action must always return an HTTP status
204.
Since Struts 6.11.0 and 7.3.0 the submitted report body is read up to a bounded length instead of being read whole. The limit defaults to 8192 characters and is configurable:
<constant name="struts.csp.report.maxSize" value="16384"/>
A report larger than the limit is discarded with a warning and processReport(String) is not called. Accepted values
are 1 to 1048576; anything outside that range is ignored, and the default applies. Raise the limit if your
browsers submit larger violation reports than the default allows.
Action aware
Since Struts 6.2.0 it is possible to configure the CSP interceptor by providing the an instance of CspSettings interface.
Please use CspSettingsAware interface and implement the getCspSettings() method to steer the policy per action.
public class MyAction implements CspSettingsAware {
public String execute() {
return "success";
}
public CspSetting getCspSettings() {
...
}
}
Examples
<action name="someAction" class="com.examples.SomeAction">
<interceptor-ref name="defaultStack">
<param name="csp.enforcingMode">true</param>
<param name="csp.reportUri">/csp-report.action</param>
</interceptor-ref>
<result name="success">good_result.ftl</result>
</action>