Enhance CSP documentation #9959
Conversation
Robinfr
commented
Aug 11, 2025
Robinfr
commented
- Add Headers custom runtime setting recommendations for nonce-based CSP
- Add CSP support section for Java request handlers
- Include CspHelper API documentation and code examples
- Provide best practices and common issue solutions for CSP implementation
- Update cloud deployment methods with clear recommendations
- Add Headers custom runtime setting recommendations for nonce-based CSP - Add CSP support section for Java request handlers - Include CspHelper API documentation and code examples - Provide best practices and common issue solutions for CSP implementation - Update cloud deployment methods with clear recommendations
|
Needs internal review |
| CSP support is only relevant for request handlers that serve static content such as HTML pages, not for API endpoints that return JSON or other data formats. | ||
| {{% /alert %}} | ||
|
|
||
| This section describes how to properly handle CSP headers in your Java request handlers when serving HTML content. |
There was a problem hiding this comment.
I am missing a small explanation about what nonces are and how they work (and maybe a link to mdn would be nice)
There was a problem hiding this comment.
I'm not exactly sure where I would put a link to MDN in this documentation? I don't want to elaborate on nonces too much to be honest. If you need to know what they are when reading this, you likely shouldn't be reading this documentation since that is an advanced topic.
There was a problem hiding this comment.
I agree that an explanation is too much, the point I was trying to make is that nonces are not introduced at all. Maybe the sentence at line 179 can be extended with:
If you are developing Marketplace modules or custom Java actions that include request handlers, you may need to implement CSP support to ensure compatibility with strict CSP policies. Nonces can be implemented to securely allow necessary inline scripts and styles while maintaining robust content security.
There was a problem hiding this comment.
I've added a short introduction to nonces referencing CSP level 2
|
@Robinfr Please let me know when the technical verification is done and when it's ready for tech writer's review. |
|
Hey @OlufunkeMoronfolu, it is ready for tech writer's review. |
