Package org.apache.struts2.interceptor.csp

Interface CspSettings

All Known Implementing Classes:

DefaultCspSettings

public interface CspSettings

CspSettings interface used by the CspInterceptor to add the CSP header to the response. The default implementation can be found in DefaultCspSettings.

See Also:

• DefaultCspSettings

Field Summary

Fields

Modifier and Type	Field	Description
static final String	BASE_URI
static final String	CSP_ENFORCE_HEADER
static final String	CSP_REPORT_HEADER
static final String	CSP_REPORT_TYPE
static final String	HTTP
static final String	HTTPS
static final int	NONCE_RANDOM_LENGTH
static final String	NONE
static final String	OBJECT_SRC
static final String	REPORT_TO
static final String	REPORT_URI
static final String	SCRIPT_SRC
static final String	STRICT_DYNAMIC

Method Summary

Modifier and Type	Method	Description
void	addCspHeaders(jakarta.servlet.http.HttpServletRequest request, jakarta.servlet.http.HttpServletResponse response)	Adds CSP related headers to response based on request state (e.g., if session has been created)
void	setEnforcingMode(boolean value)	Sets CSP headers in enforcing mode when true, and report-only when false
void	setReportTo(String group)	Sets the report group where csp violation reports will be sent
void	setReportUri(String uri)	Sets the uri where csp violation reports will be sent

Field Details

NONCE_RANDOM_LENGTH

static final int NONCE_RANDOM_LENGTH

See Also:

• Constant Field Values

CSP_ENFORCE_HEADER

static final String CSP_ENFORCE_HEADER

See Also:

• Constant Field Values

CSP_REPORT_HEADER

static final String CSP_REPORT_HEADER

See Also:

• Constant Field Values

OBJECT_SRC

static final String OBJECT_SRC

See Also:

• Constant Field Values

SCRIPT_SRC

static final String SCRIPT_SRC

See Also:

• Constant Field Values

BASE_URI

static final String BASE_URI

See Also:

• Constant Field Values

REPORT_URI

static final String REPORT_URI

See Also:

• Constant Field Values

REPORT_TO

static final String REPORT_TO

See Also:

• Constant Field Values

NONE

static final String NONE

See Also:

• Constant Field Values

STRICT_DYNAMIC

static final String STRICT_DYNAMIC

See Also:

• Constant Field Values

HTTP

static final String HTTP

See Also:

• Constant Field Values

HTTPS

static final String HTTPS

See Also:

• Constant Field Values

CSP_REPORT_TYPE

static final String CSP_REPORT_TYPE

See Also:

• Constant Field Values

Method Details

addCspHeaders

void addCspHeaders(jakarta.servlet.http.HttpServletRequest request,
 jakarta.servlet.http.HttpServletResponse response)

Adds CSP related headers to response based on request state (e.g., if session has been created)

Since:

Struts 6.0.3

setReportUri

void setReportUri(String uri)

Sets the uri where csp violation reports will be sent

setReportTo

void setReportTo(String group)

Sets the report group where csp violation reports will be sent

Since:

Struts 6.5.0

setEnforcingMode

void setEnforcingMode(boolean value)

Sets CSP headers in enforcing mode when true, and report-only when false