Search code examples
jsfprimefacescontent-security-policy

content-security-policy header for a jsf, primefaces application

As JSF and Primefaces components result in inline scripts, it is difficult to configure the CSP header in its best configuration.

As JSF by design provides XSS protection, is it okay to not use CSP at all or what shall be the best CSP value for a JSF+Primefaces application?

Also, there is not much discussion/sample-code available on the topic on Internet [1][2]. Aren't JSF and Primefaces planning to provide easier implementation of CSP, as it is 'defense-in-depth', highly recommended header?

Solution

  • To enable it you may add the following context parameter to your web.xml:

    <context-param>
<param-name>primefaces.CSP</param-name>
<param-value>true</param-value>