[
https://issues.apache.org/jira/browse/WICKET-5406?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=16879617#comment-16879617
]
Andrew Kondratev commented on WICKET-5406:
------------------------------------------
[~keesvandieren] I didn't proceed with the prototype a lot, was very busy at
work. I have some very simple proof of concept here:
https://github.com/andruhon/WicketFetch/commit/e9611a217295696cf3ce3dd415c28dcbc0e013d5
Please let me know if you're interesting in helping me with it.
I also created jira to add nonce to the javascript header item
https://issues.apache.org/jira/browse/WICKET-6682
> Better Content Security Policy Support
> --------------------------------------
>
> Key: WICKET-5406
> URL: https://issues.apache.org/jira/browse/WICKET-5406
> Project: Wicket
> Issue Type: Improvement
> Components: wicket
> Reporter: Mario Groß
> Priority: Minor
> Labels: CSP, Content-Security-Policy, Cross-site-Scripting,
> Security
>
> A better support of the Content Security Policy
> (http://en.wikipedia.org/wiki/Content_Security_Policy) would protect against
> cross-site scripting attacks and improve the security image of wicket.
> The main problem at the moment is the heavily used inline javascript code
> which interferes with the whitelisting mechanism of script sources in the CSP
> and should be avoided .
--
This message was sent by Atlassian JIRA
(v7.6.3#76005)
