search

tokensmith / otter

micro web framework for servlet api 4.0.1
MIT License
5 stars 0 forks source link

CSP #185

Closed tmackenzie closed 4 years ago

tmackenzie commented 4 years ago

Add the header, Content-Security-Policy with the default value, default-src: 'self'; The value should be able to be overridden in shape. Possibly with a group and target.

Doing so will make it harder for XSS attacks per OSWAP

Its specifically defined here

tmackenzie commented 4 years ago

This should be the application's responsibility via a before and or after.