Support nonce-based Content Security Policy - #18499

Open

ziqin wants to merge 26 commits into

spring-projects:mainfrom

Commits on Mar 29, 2026

Fix method chaining for ContentSecurityPolicySpec
ziqin
committed
381dc38
Support nonce-based Content-Security-Policy
ziqin
committed
a91d888
Support configuring nonce-based Content-Security-Policy
ziqin
committed
0ecdc80

Commits on Apr 3, 2026

Revert "Fix method chaining for ContentSecurityPolicySpec"
ziqin
committed
1cec465
Make nonce-generating filters ad hoc instead of general-purpose
ziqin
committed
66c0242
Defer CSP nonce generation
ziqin
committed
56e3884
Remove Javadoc since tags in CSP tests
ziqin
committed
6e3e094
Fix typo in ContentSecurityPolicyDsl KDoc
ziqin
committed
855e946
Separate internal nonce attr from attr exposed for views
ziqin
committed
bf6f1d4
Rename requireCspMatcher to requestMatcher
ziqin
committed
4c838b3
Polish filter chain config for CSP
ziqin
committed
acf956a
Remove isNonceBased() from header writers
ziqin
committed
939ae10
Avoid tying CSP {nonce} placeholder to specific stacks
ziqin
committed
f666e44

Commits on Apr 4, 2026

Deprecate ContentSecurityPolicySpec#reportOnly(boolean)
ziqin
committed
11279f9
Deprecate ContentSecurityPolicySpec#policyDirectives(String)
ziqin
committed
32a8249

Commits on Sep 3, 2026

Revert deprecation about method chaining in ContentSecurityPolicySpec
ziqin
committed
0fbc676

Commits on Sep 6, 2026

Move request matcher to CSP header writer and improve config
ziqin
committed
6c1fbf3
Undo changes about header writer disabling and composition
ziqin
committed
15a761e
Avoid failing fast in CompositeServerHttpHeadersWriter
ziqin
committed
2be35ce
Avoid failing fast in CompositeHeaderWriter
ziqin
committed
cba8dd8
Undo changes on visibility of CSP header constants
ziqin
committed
3dae3b0
Introduce a getter for CSP nonce
ziqin
committed
aeeafb9
Update Javadoc @since version for nonce-based CSP to 7.2
ziqin
committed
9ebbf70

Commits on Sep 10, 2026

Support nonce-based CSP in XML namespace config
ziqin
committed
55d55a9
Remove isNonceBased field from ContentSecurityPolicyHeaderWriter
ziqin
committed
d0733be

Commits on Sep 25, 2026

Remove isNonceBased from ContentSecurityPolicyServerHttpHeadersWriter
ziqin
committed
8298ded