Package org.apache.juneau.http.header

Class ContentSecurityPolicy.Builder

java.lang.Object
org.apache.juneau.http.header.ContentSecurityPolicy.Builder
Enclosing class:
ContentSecurityPolicy
public static class ContentSecurityPolicy.Builder extends Object
Fluent builder for assembling a Content-Security-Policy header value.

Composes the directives defined by CSP Level 3 into the directive source source; ... wire format expected by the Content-Security-Policy response header. Typed setters cover the common directives; directive(String, String...) is a generic escape hatch so new directives never require an API change. Setting the same directive more than once replaces the previous source list.

Example:

String value = ContentSecurityPolicy.create() .defaultSrc(SELF) .imgSrc(SELF, "data:") .objectSrc(NONE) .build(); // => "default-src 'self'; img-src 'self' data:; object-src 'none'"

Nonces:

Source helper nonce(String) renders a 'nonce-<token>' source expression. For per-request nonces (where the actual token is not known until the response is rendered), use NONCE_PLACEHOLDER as the token and have the REST layer rewrite it per-response via resolveNonce(String, String); the same nonce is then stamped onto the inline <script>/<style> tags the serializer emits.

See Also:
Since:
10.0.0