search

zio / zio-http

A next-generation Scala framework for building scalable, correct, and efficient HTTP clients and servers
https://zio.dev/zio-http
Apache License 2.0
800 stars 403 forks source link

Add Support for Content-Security-Policy-Report-Only Header #3172

Open Saturn225 opened 1 month ago

Saturn225 commented 1 month ago

The Content-Security-Policy-Report-Only header is used to monitor potential violations of Content-Security-Policy (CSP) without enforcing it. This allows developers to test CSP policies by sending violation reports to specified URIs without blocking any resources. Adding this header to ZIO-HTTP would help monitor and secure web applications by detecting security risks without breaking functionality.

Requirements:

  1. Implement support for the Content-Security-Policy-Report-Only header.
  2. Allow setting multiple policies for different resource types (e.g., script-src, img-src, etc.).
  3. Add test cases to ensure correct behavior and conformance with the CSP specification.

Reference: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy-Report-Only https://content-security-policy.com/report-only/