From 3e47531b1901f14c64ef7df474e18614e3ce8891 Mon Sep 17 00:00:00 2001 From: Rob Winch Date: Tue, 22 Mar 2016 22:32:23 -0500 Subject: [PATCH] Polish CSP reference Issue gh-3763 --- docs/manual/src/docs/asciidoc/index.adoc | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/docs/manual/src/docs/asciidoc/index.adoc b/docs/manual/src/docs/asciidoc/index.adoc index 0e237a102c..464c994a9d 100644 --- a/docs/manual/src/docs/asciidoc/index.adoc +++ b/docs/manual/src/docs/asciidoc/index.adoc @@ -3917,7 +3917,7 @@ protected void configure(HttpSecurity http) throws Exception { } ---- -[[headers-content-security-policy]] +[[headers-csp]] ==== Content Security Policy (CSP) https://www.w3.org/TR/CSP2/[Content Security Policy (CSP)] is a mechanism that web applications can leverage to mitigate content injection vulnerabilities, @@ -3975,6 +3975,7 @@ If the site violates this policy, by attempting to load a script from _evil.com_ the user-agent will send a violation report to the declared URL specified by the _report-uri_ directive, but still allow the violating resource to load nevertheless. +[[headers-csp-configure]] ===== Configuring Content Security Policy It's important to note that Spring Security *_does not add_* Content Security Policy by default. @@ -4053,6 +4054,7 @@ protected void configure(HttpSecurity http) throws Exception { } ---- +[[headers-csp-links]] ===== Additional Resources Applying Content Security Policy to a web application is often a non-trivial undertaking.