{"id":108419,"date":"2021-01-14T10:00:00","date_gmt":"2021-01-14T08:00:00","guid":{"rendered":"https:\/\/www.javacodegeeks.com\/?p=108419"},"modified":"2021-01-11T19:48:40","modified_gmt":"2021-01-11T17:48:40","slug":"content-security-policy-nonce-with-spring-security","status":"publish","type":"post","link":"https:\/\/www.javacodegeeks.com\/2021\/01\/content-security-policy-nonce-with-spring-security.html","title":{"rendered":"Content-Security-Policy Nonce with Spring Security"},"content":{"rendered":"

Content-Security-Policy<\/a> is important for web security. Yet, it\u2019s not mainstream yet, it\u2019s syntax is hard, it\u2019s rather prohibitive and tools rarely have flexible support for it.<\/p>\n

While Spring Security does have a built-in Content Security Policy (CSP) configuration, it allows you to specify the policy a a string, not build it dynamically. And in some cases you need more than that.<\/p>\n

In particular, CSP discourages the user of inline javascript, because it introduces vulnerabilities. If you really need it, you can use unsafe-inline<\/code><\/a> but that\u2019s a bad approach, as it negates the whole point of CSP. The alternative presented on that page is to use hash<\/code> or nonce<\/code>.<\/p>\n

I\u2019ll explain how to use nonce with spring security, if you are using\u00a0.and().headers().contentSecurityPolicy(policy)<\/code>. The policy string is static, so you can\u2019t generate a random nonce for each request. And having a static nonce is useless. So first, you define a CSP nonce filter:<\/p>\n

\npublic class CSPNonceFilter extends GenericFilterBean {\n    private static final int NONCE_SIZE = 32; \/\/recommended is at least 128 bits\/16 bytes\n    private static final String CSP_NONCE_ATTRIBUTE = \"cspNonce\";\n \n    private SecureRandom secureRandom = new SecureRandom();\n \n    @Override\n    public void doFilter(ServletRequest req, ServletResponse res, FilterChain chain) throws IOException, ServletException {\n        HttpServletRequest request = (HttpServletRequest) req;\n        HttpServletResponse response = (HttpServletResponse) res;\n \n        byte[] nonceArray = new byte[NONCE_SIZE];\n \n        secureRandom.nextBytes(nonceArray);\n \n        String nonce = Base64.getEncoder().encodeToString(nonceArray);\n        request.setAttribute(CSP_NONCE_ATTRIBUTE, nonce);\n \n        chain.doFilter(request, new CSPNonceResponseWrapper(response, nonce));\n    }\n \n    \/**\n     * Wrapper to fill the nonce value\n     *\/\n    public static class CSPNonceResponseWrapper extends HttpServletResponseWrapper {\n        private String nonce;\n \n        public CSPNonceResponseWrapper(HttpServletResponse response, String nonce) {\n            super(response);\n            this.nonce = nonce;\n        }\n \n        @Override\n        public void setHeader(String name, String value) {\n            if (name.equals(\"Content-Security-Policy\") && StringUtils.isNotBlank(value)) {\n                super.setHeader(name, value.replace(\"{nonce}\", nonce));\n            } else {\n                super.setHeader(name, value);\n            }\n        }\n \n        @Override\n        public void addHeader(String name, String value) {\n            if (name.equals(\"Content-Security-Policy\") && StringUtils.isNotBlank(value)) {\n                super.addHeader(name, value.replace(\"{nonce}\", nonce));\n            } else {\n                super.addHeader(name, value);\n            }\n        }\n    }\n}\n<\/pre>\n
And then you configure it with spring security using: .addFilterBefore(new CSPNonceFilter(), HeaderWriterFilter.class)<\/code>.
 
<\/div> <\/div><\/p>\n
The policy string should containt `nonce-{nonce}`<\/code> which would get replaced with a random nonce on each request.<\/p>\n
The filter is set before the HeaderWriterFilter<\/code> so that it can wrap the response and intercept all calls to setting headers. Why it can\u2019t be done by just overriding the headers after they are set by the HeaderWriterFiilter, using response.setHeader(..) \u2013 because the response is already committed and overriding does nothing.<\/p>\n
Then in your pages where you for some reason need inline scripts, you can use:<\/p>\n
\n