andruhon commented on a change in pull request #382: WICKET-6688 add RFC and
replace eval with DOM eval
URL: https://github.com/apache/wicket/pull/382#discussion_r323481228
##########
File path:
wicket-examples/src/main/java/org/apache/wicket/examples/csp/CspApplication.java
##########
@@ -45,9 +51,22 @@ protected void init()
{
super.init();
- setHeaderResponseDecorator(response -> new
ResourceAggregator(new CspNonceHeaderResponse(response, getNonce())));
+ // Decorate all header items with nonce
+ setHeaderResponseDecorator(response -> new ResourceAggregator(
+ isCspApplicable() ? new
CspNonceHeaderResponse(response, getNonce()) : response
+ ));
+ // add nonce to ajax response
+ getAjaxRequestTargetListeners().add((new
AjaxRequestTarget.IListener()
+ {
+ @Override
+ public void onBeforeRespond(Map<String, Component> map,
AjaxRequestTarget target)
+ {
+ target.addMeta("nonce", getNonce());
Review comment:
Thanks @martin-g !
Honestly I'm not quite sure about this meta container. I was thinking about
1. placing a nonce as an attribute of `ajax-response`;
2. placing a nonce as a direct child of `ajax response`, without any kind of
`meta` container;
3. adding some kind of universal container to add anything.
This one implements 3. What do you think maybe one of 1 or 2 is better?
----------------------------------------------------------------
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
For queries about this service, please contact Infrastructure at:
[email protected]
With regards,
Apache Git Services
