CODEWITHSUNDEEP
scalaplayframeworkresponse-headers
eje211
eje211

Reputation: 2429

Play framework custom headers ignored

I have this very simple Play controller:

@Singleton
class Application @Inject()(cc: ControllerComponents) extends AbstractController(cc) {
  def index = Action {
    Ok(views.html.index(SharedMessages.itWorks))
      .withHeaders("Content-Security-Policy" -> "script-src 'unsafe-eval'")
  }
}

But the added header is ignored. The Content Security Policy in the rendered page is the default one:

Content-Security-Policy: default-src 'self'

Why is that?

Upvotes: 2

Views: 202

Answers (1)

Harald Gliebe
Harald Gliebe

Reputation: 7544

Do you have Play!'s security filter enabled? In that case you have to set the CSP header in the application.conf configuration file instead of adding it manually.

See Play! SecurityHeaders for details.

Upvotes: 1

Related Questions