CODEWITHSUNDEEP
jsfprimefacescontent-security-policy
mittal
mittal

Reputation: 335

content-security-policy header for a jsf, primefaces application

As JSF and Primefaces components result in inline scripts, it is difficult to configure the CSP header in its best configuration.

As JSF by design provides XSS protection, is it okay to not use CSP at all or what shall be the best CSP value for a JSF+Primefaces application?

Also, there is not much discussion/sample-code available on the topic on Internet [1][2]. Aren't JSF and Primefaces planning to provide easier implementation of CSP, as it is 'defense-in-depth', highly recommended header?

Upvotes: 4

Views: 3735

Answers (1)

Adane kasie
Adane kasie

Reputation: 71

To enable it you may add the following context parameter to your web.xml:

<context-param>
<param-name>primefaces.CSP</param-name>
<param-value>true</param-value>

Upvotes: 3

Related Questions