[
https://issues.apache.org/jira/browse/WICKET-7092?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=17803055#comment-17803055
]
Emond Papegaaij commented on WICKET-7092:
-----------------------------------------
Base64 has 2 commonly used alphabets, normal and URL. The problem with + and /
is that they have special meaning in URLs, the URL safe alphabet prevents this
by using - and _. Both are valid base64 alphabets. The CSP spec doesn't state
which base64 alphabet to use and the ABNF for nonce allows both, so I would say
both are equally valid and the tool used by the reporter is wrong.
> Content Security Policy 'Nonces should only use the base64 charset'
> -------------------------------------------------------------------
>
> Key: WICKET-7092
> URL: https://issues.apache.org/jira/browse/WICKET-7092
> Project: Wicket
> Issue Type: Bug
> Components: wicket-core
> Affects Versions: 9.16.0
> Environment: Kali Linux
> Reporter: sundar
> Priority: Minor
> Attachments: image-20240103-092246.png
>
>
> Hi all, I applied a strict content security policy to my application using
> wicket after I tested my application using Kali Linux to check for
> vulnerabilities. The tool provides the report with an info message "Nonces
> should only use the base64 charset" regarding the info message needed to
> configure any properties in CSP. I attached the report screenshotÂ
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
