Content Security Policy (CSP) is a critical security layer that helps detect and mitigate certain types of attacks, including Cross-Site Scripting (XSS) and data injection attacks. This article provides a comprehensive guide to understanding, implementing, and managing CSP headers in Java web applications, covering everything from basic setup to advanced reporting and monitoring.

Understanding Content Security Policy (CSP)

CSP is a security standard that allows web developers to control which resources the browser is allowed to load for a given page. Instead of trusting everything the server sends, CSP creates a whitelist of trusted content sources and blocks anything not explicitly allowed.

How CSP Works:

• The server sends a Content-Security-Policy HTTP header with policy directives
• The browser enforces these policies when loading resources
• Violations can be reported back to the server for monitoring

Common Attack Vectors CSP Prevents:

• Cross-Site Scripting (XSS)
• Clickjacking
• Mixed content issues
• Data injection attacks

CSP Directives and Policies

Here are the most commonly used CSP directives:

// Example CSP Policy String cspPolicy = "default-src 'self'; " + "script-src 'self' https://trusted-cdn.com; " + "style-src 'self' 'unsafe-inline'; " + "img-src 'self' data: https:; " + "connect-src 'self'; " + "font-src 'self'; " + "object-src 'none'; " + "frame-ancestors 'none'; " + "base-uri 'self'; " + "form-action 'self'; " + "report-uri /csp-violation-report-endpoint";

Key Directives:

• default-src: Fallback for other resource types
• script-src: Controls JavaScript sources
• style-src: Controls CSS and stylesheet sources
• img-src: Controls image sources
• connect-src: Controls XMLHttpRequest, WebSocket, and EventSource
• font-src: Controls web font sources
• frame-ancestors: Prevents clickjacking
• report-uri: Where to send violation reports

Implementing CSP in Java Applications

1. Servlet Filter Approach (Most Common)

import javax.servlet.*; import javax.servlet.http.HttpServletRequest; import javax.servlet.http.HttpServletResponse; import java.io.IOException; public class CspHeaderFilter implements Filter { private String cspPolicy; @Override public void init(FilterConfig filterConfig) { // Build CSP policy this.cspPolicy = buildCspPolicy(); } @Override public void doFilter(ServletRequest request, ServletResponse response, FilterChain chain) throws IOException, ServletException { HttpServletResponse httpResponse = (HttpServletResponse) response; // Add CSP header httpResponse.setHeader("Content-Security-Policy", cspPolicy); // Optional: Add report-only header for testing // httpResponse.setHeader("Content-Security-Policy-Report-Only", cspPolicy); chain.doFilter(request, response); } private String buildCspPolicy() { return String.join("; ", "default-src 'self'", "script-src 'self' 'unsafe-inline' https://cdnjs.cloudflare.com", "style-src 'self' 'unsafe-inline' https://fonts.googleapis.com", "img-src 'self' data: https:", "font-src 'self' https://fonts.gstatic.com", "connect-src 'self'", "object-src 'none'", "frame-ancestors 'none'", "base-uri 'self'", "form-action 'self'", "report-uri /api/csp-violation" ); } @Override public void destroy() { // Cleanup if needed } }

Web.xml Configuration:

<filter> <filter-name>CspHeaderFilter</filter-name> <filter-class>com.example.CspHeaderFilter</filter-class> </filter> <filter-mapping> <filter-name>CspHeaderFilter</filter-name> <url-pattern>/*</url-pattern> </filter-mapping>

2. Spring Security Configuration

import org.springframework.context.annotation.Bean; import org.springframework.context.annotation.Configuration; import org.springframework.security.config.annotation.web.builders.HttpSecurity; import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity; import org.springframework.security.web.SecurityFilterChain; import org.springframework.security.web.header.writers.StaticHeadersWriter; @Configuration @EnableWebSecurity public class SecurityConfig { @Bean public SecurityFilterChain filterChain(HttpSecurity http) throws Exception { http // Other security configurations .csrf().disable() .headers(headers -> headers .contentSecurityPolicy(csp -> csp .policyDirectives(buildCspPolicy()) ) .frameOptions().deny() .xssProtection().block(true) ); return http.build(); } private String buildCspPolicy() { return String.join("; ", "default-src 'self'", "script-src 'self' 'nonce-{nonce}' https://trusted-cdn.com", "style-src 'self' 'unsafe-inline'", "img-src 'self' data: https:", "font-src 'self' https://fonts.gstatic.com", "connect-src 'self'", "object-src 'none'", "frame-ancestors 'none'", "base-uri 'self'", "form-action 'self'", "report-uri /api/security/csp-report" ); } }

3. Spring Boot with Custom Headers

import org.springframework.boot.web.servlet.FilterRegistrationBean; import org.springframework.context.annotation.Bean; import org.springframework.context.annotation.Configuration; import org.springframework.web.servlet.config.annotation.WebMvcConfigurer; @Configuration public class CspConfig implements WebMvcConfigurer { @Bean public FilterRegistrationBean<CspHeaderFilter> cspFilter() { FilterRegistrationBean<CspHeaderFilter> registrationBean = new FilterRegistrationBean<>(); registrationBean.setFilter(new CspHeaderFilter()); registrationBean.addUrlPatterns("/*"); registrationBean.setOrder(1); return registrationBean; } }

Advanced CSP Implementation

Nonce-based CSP for Dynamic Content

import javax.servlet.http.HttpServletRequest; import java.security.SecureRandom; import java.util.Base64; public class NonceGenerator { private static final SecureRandom secureRandom = new SecureRandom(); private static final Base64.Encoder base64Encoder = Base64.getEncoder(); public static String generateNonce() { byte[] randomBytes = new byte[16]; secureRandom.nextBytes(randomBytes); return base64Encoder.encodeToString(randomBytes); } public static String addNonceToCsp(String cspPolicy, String nonce) { return cspPolicy.replace("{nonce}", "'nonce-" + nonce + "'"); } } // Enhanced CSP Filter with Nonce Support public class NonceCspFilter implements Filter { @Override public void doFilter(ServletRequest request, ServletResponse response, FilterChain chain) throws IOException, ServletException { HttpServletRequest httpRequest = (HttpServletRequest) request; HttpServletResponse httpResponse = (HttpServletResponse) response; // Generate nonce for this request String nonce = NonceGenerator.generateNonce(); // Store nonce in request for use in JSP/templates httpRequest.setAttribute("cspNonce", nonce); // Build CSP policy with nonce String cspPolicy = buildCspPolicy(nonce); httpResponse.setHeader("Content-Security-Policy", cspPolicy); chain.doFilter(request, response); } private String buildCspPolicy(String nonce) { return String.join("; ", "default-src 'self'", "script-src 'self' 'nonce-" + nonce + "' https://trusted-cdn.com", "style-src 'self' 'unsafe-inline'", "img-src 'self' data: https:", "font-src 'self'", "connect-src 'self'", "object-src 'none'", "frame-ancestors 'none'", "report-uri /api/csp-violation" ); } }

Using Nonce in JSP:

<script nonce="${cspNonce}"> // This inline script will execute because it has a valid nonce console.log('Secure inline script'); </script> <script src="https://trusted-cdn.com/library.js"></script>

CSP Violation Reporting

Violation Report Endpoint

import org.springframework.web.bind.annotation.*; import javax.servlet.http.HttpServletRequest; import java.io.BufferedReader; @RestController @RequestMapping("/api/security") public class CspReportController { @PostMapping("/csp-report") public void handleCspViolation(HttpServletRequest request) { try { // Read the violation report StringBuilder reportBuilder = new StringBuilder(); try (BufferedReader reader = request.getReader()) { String line; while ((line = reader.readLine()) != null) { reportBuilder.append(line); } } String violationReport = reportBuilder.toString(); // Log the violation (in production, send to monitoring system) logViolation(violationReport); } catch (Exception e) { // Don't throw exceptions from violation reports System.err.println("Error processing CSP violation: " + e.getMessage()); } } private void logViolation(String violationReport) { // In production, send to your logging/monitoring system System.out.println("CSP Violation: " + violationReport); // Example: Send to log file, SIEM, or security monitoring service // logger.warn("CSP Violation detected: {}", violationReport); } }

Violation Report Model

import com.fasterxml.jackson.annotation.JsonProperty; import java.time.Instant; public class CspViolationReport { @JsonProperty("csp-report") private CspReport cspReport; // Getters and setters public static class CspReport { private String documentUri; private String referrer; private String blockedUri; private String violatedDirective; private String effectiveDirective; private String originalPolicy; private String disposition; private String scriptSample; private int statusCode; private String sourceFile; private int lineNumber; private int columnNumber; // Getters and setters public String getDocumentUri() { return documentUri; } public void setDocumentUri(String documentUri) { this.documentUri = documentUri; } public String getBlockedUri() { return blockedUri; } public void setBlockedUri(String blockedUri) { this.blockedUri = blockedUri; } public String getViolatedDirective() { return violatedDirective; } public void setViolatedDirective(String violatedDirective) { this.violatedDirective = violatedDirective; } // ... other getters and setters } }

Environment-Specific CSP Policies

public class CspPolicyBuilder { public enum Environment { DEVELOPMENT, STAGING, PRODUCTION } public static String buildPolicy(Environment env, String nonce) { switch (env) { case DEVELOPMENT: return buildDevelopmentPolicy(nonce); case STAGING: return buildStagingPolicy(nonce); case PRODUCTION: return buildProductionPolicy(nonce); default: return buildStrictPolicy(nonce); } } private static String buildDevelopmentPolicy(String nonce) { // More permissive for development return String.join("; ", "default-src 'self' 'unsafe-eval'", // Allow eval for development "script-src 'self' 'unsafe-eval' 'nonce-" + nonce + "'", "style-src 'self' 'unsafe-inline'", "img-src 'self' data: https:", "connect-src 'self' ws: wss:", // Allow WebSockets "font-src 'self'", "object-src 'none'", "frame-ancestors 'none'", "report-uri /api/csp-violation" ); } private static String buildProductionPolicy(String nonce) { // Strict policy for production return String.join("; ", "default-src 'self'", "script-src 'self' 'nonce-" + nonce + "' https://cdn.example.com", "style-src 'self'", "img-src 'self' data: https:", "connect-src 'self' https://api.example.com", "font-src 'self'", "object-src 'none'", "frame-ancestors 'none'", "base-uri 'self'", "form-action 'self'", "report-uri /api/csp-violation" ); } }

Testing CSP Implementation

JUnit Test for CSP Headers

import org.junit.jupiter.api.Test; import org.springframework.beans.factory.annotation.Autowired; import org.springframework.boot.test.autoconfigure.web.servlet.AutoConfigureMockMvc; import org.springframework.boot.test.context.SpringBootTest; import org.springframework.test.web.servlet.MockMvc; import static org.springframework.test.web.servlet.request.MockMvcRequestBuilders.get; import static org.springframework.test.web.servlet.result.MockMvcResultMatchers.header; @SpringBootTest @AutoConfigureMockMvc public class CspHeaderTest { @Autowired private MockMvc mockMvc; @Test void testCspHeaderPresent() throws Exception { mockMvc.perform(get("/")) .andExpect(header().exists("Content-Security-Policy")) .andExpect(header().string("Content-Security-Policy", org.hamcrest.Matchers.containsString("default-src 'self'"))); } @Test void testCspHeaderContainsExpectedDirectives() throws Exception { mockMvc.perform(get("/")) .andExpect(header().string("Content-Security-Policy", org.hamcrest.Matchers.allOf( org.hamcrest.Matchers.containsString("script-src"), org.hamcrest.Matchers.containsString("style-src"), org.hamcrest.Matchers.containsString("object-src 'none'") ))); } }

Integration Test for Violation Reporting

@Test void testCspViolationReporting() throws Exception { String violationReport = """ { "csp-report": { "document-uri": "https://example.com/page", "blocked-uri": "https://malicious.com/script.js", "violated-directive": "script-src", "original-policy": "script-src 'self'" } } """; mockMvc.perform(post("/api/security/csp-report") .contentType("application/csp-report") .content(violationReport)) .andExpect(status().isOk()); }

Best Practices for CSP in Java

1. Start with Report-Only Mode:

// Use during development and testing httpResponse.setHeader("Content-Security-Policy-Report-Only", cspPolicy);

2. Implement Progressive Security:

public class ProgressiveCspStrategy { public String getCspPolicy(HttpServletRequest request) { if (isNewUser(request)) { return buildPermissivePolicy(); // Learn what resources are needed } else { return buildStrictPolicy(); // Enforce strict policy } } }

3. Use Nonces for Dynamic Content:

// Instead of 'unsafe-inline', use nonces for inline scripts/styles "script-src 'self' 'nonce-RANDOM123'"

4. Monitor and Adapt:

@Component public class CspViolationMonitor { @EventListener public void handleCspViolation(CspViolationEvent event) { // Analyze patterns and adjust policies if (isCommonFalsePositive(event)) { adjustPolicyForLegacyFeatures(); } } }

Common CSP Challenges and Solutions

Challenge 1: Third-party Widgets

// Solution: Allow specific third-party sources String cspForThirdParty = String.join("; ", "default-src 'self'", "script-src 'self' https://widgets.example.com", "frame-src https://embed.example.com", "connect-src 'self' https://api.thirdparty.com" );

Challenge 2: Legacy Applications

// Gradual implementation strategy public class GradualCspFilter implements Filter { private int implementationPhase = 1; private String getPolicyForPhase() { switch (implementationPhase) { case 1: return buildReportOnlyPolicy(); case 2: return buildPermissiveEnforcingPolicy(); case 3: return buildStrictPolicy(); default: return buildStrictPolicy(); } } }

Conclusion

Implementing Content Security Policy in Java applications provides a powerful defense against XSS and other code injection attacks. By following these practices:

• Start with reporting to identify needed resources
• Use nonces for dynamic content instead of unsafe-inline
• Implement environment-specific policies
• Monitor violations and continuously refine policies
• Use frameworks like Spring Security for consistent implementation

CSP significantly enhances your application's security posture. Remember that CSP is not a one-time setup but an ongoing process of monitoring, analysis, and policy refinement as your application evolves.