[
https://issues.apache.org/jira/browse/WICKET-6821?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
]
Sven Meier resolved WICKET-6821.
--------------------------------
Resolution: Fixed
Header decoration has an implied order that has to be preserved:
Even when the CSP decoration is added late (i.e. in #validateInit()), the
decoration still has to be happen *after* any filter of header items, otherwise
there's no way to add the nonce attribute.
For this HeaderResponseDecoratorCollection had to be extended to allow
inserting a decorator immediately before resource aggregation.
I'm not too happy with this solution, but it works now.
> Completely disable CSP support
> ------------------------------
>
> Key: WICKET-6821
> URL: https://issues.apache.org/jira/browse/WICKET-6821
> Project: Wicket
> Issue Type: Improvement
> Components: wicket
> Reporter: Sven Meier
> Assignee: Sven Meier
> Priority: Minor
> Fix For: 9.1.0
>
>
> In discussions of WICKET-6805 the question came up, whether we should allow
> complete disabling of CSP too, i.e. don't add any listeners and/or decorators
> when no CSP was configured.
--
This message was sent by Atlassian Jira
(v8.3.4#803005)
