Package io.camunda.security.configuration.headers

Class ContentSecurityPolicyConfig

java.lang.Object
io.camunda.security.configuration.headers.ContentSecurityPolicyConfig
public class ContentSecurityPolicyConfig extends Object
Configures Content Security Policy (CSP) to prevent XSS and other content injection attacks.

CSP allows fine-grained control over which resources can be loaded, providing defense-in-depth against Cross-Site Scripting (XSS), clickjacking, and other code injection attacks. When enabled (default state), CSP instructs browsers to only load resources from approved sources.

Default policies taken from Operate/Tasklist prior to 8.7 release, aggregated together.

See Also:

  • Field Details

  • Constructor Details

    • ContentSecurityPolicyConfig

      public ContentSecurityPolicyConfig()

  • Method Details

    • isEnabled

      public boolean isEnabled()

    • setEnabled

      public void setEnabled(boolean enabled)

    • isDisabled

      public boolean isDisabled()

    • getPolicyDirectives

      public String getPolicyDirectives()

    • setPolicyDirectives

      public void setPolicyDirectives(String policyDirectives)

    • isReportOnly

      public boolean isReportOnly()

    • setReportOnly

      public void setReportOnly(boolean reportOnly)