---

Content Security Policy (CSP) is a critical security layer that helps detect and mitigate certain types of attacks, including Cross-Site Scripting (XSS) and data injection attacks. This article provides a comprehensive guide to understanding, implementing, and managing CSP headers in Java web applications, covering everything from basic setup to advanced reporting and monitoring.

---

Understanding Content Security Policy (CSP)

CSP is a security standard that allows web developers to control which resources the browser is allowed to load for a given page. Instead of trusting everything the server sends, CSP creates a whitelist of trusted content sources and blocks anything not explicitly allowed.

How CSP Works:

• The server sends a Content-Security-Policy HTTP header with policy directives
• The browser enforces these policies when loading resources
• Violations can be reported back to the server for monitoring

Common Attack Vectors CSP Prevents:

• Cross-Site Scripting (XSS)
• Clickjacking
• Mixed content issues
• Data injection attacks

---

CSP Directives and Policies

Here are the most commonly used CSP directives:

// Example CSP Policy
String cspPolicy = "default-src 'self'; " +
                   "script-src 'self' https://trusted-cdn.com; " +
                   "style-src 'self' 'unsafe-inline'; " +
                   "img-src 'self' data: https:; " +
                   "connect-src 'self'; " +
                   "font-src 'self'; " +
                   "object-src 'none'; " +
                   "frame-ancestors 'none'; " +
                   "base-uri 'self'; " +
                   "form-action 'self'; " +
                   "report-uri /csp-violation-report-endpoint";

Key Directives:

• default-src: Fallback for other resource types
• script-src: Controls JavaScript sources
• style-src: Controls CSS and stylesheet sources
• img-src: Controls image sources
• connect-src: Controls XMLHttpRequest, WebSocket, and EventSource
• font-src: Controls web font sources
• frame-ancestors: Prevents clickjacking
• report-uri: Where to send violation reports

---

Implementing CSP in Java Applications

1. Servlet Filter Approach (Most Common)

import javax.servlet.*;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;
import java.io.IOException;

public class CspHeaderFilter implements Filter {

    private String cspPolicy;

    @Override
    public void init(FilterConfig filterConfig) {
        // Build CSP policy
        this.cspPolicy = buildCspPolicy();
    }

    @Override
    public void doFilter(ServletRequest request, ServletResponse response, 
                        FilterChain chain) throws IOException, ServletException {

        HttpServletResponse httpResponse = (HttpServletResponse) response;

        // Add CSP header
        httpResponse.setHeader("Content-Security-Policy", cspPolicy);

        // Optional: Add report-only header for testing
        // httpResponse.setHeader("Content-Security-Policy-Report-Only", cspPolicy);

        chain.doFilter(request, response);
    }

    private String buildCspPolicy() {
        return String.join("; ",
            "default-src 'self'",
            "script-src 'self' 'unsafe-inline' https://cdnjs.cloudflare.com",
            "style-src 'self' 'unsafe-inline' https://fonts.googleapis.com",
            "img-src 'self' data: https:",
            "font-src 'self' https://fonts.gstatic.com",
            "connect-src 'self'",
            "object-src 'none'",
            "frame-ancestors 'none'",
            "base-uri 'self'",
            "form-action 'self'",
            "report-uri /api/csp-violation"
        );
    }

    @Override
    public void destroy() {
        // Cleanup if needed
    }
}

Web.xml Configuration:

<filter>
    <filter-name>CspHeaderFilter</filter-name>
    <filter-class>com.example.CspHeaderFilter</filter-class>
</filter>
<filter-mapping>
    <filter-name>CspHeaderFilter</filter-name>
    <url-pattern>/*</url-pattern>
</filter-mapping>

2. Spring Security Configuration

import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
import org.springframework.security.web.SecurityFilterChain;
import org.springframework.security.web.header.writers.StaticHeadersWriter;

@Configuration
@EnableWebSecurity
public class SecurityConfig {

    @Bean
    public SecurityFilterChain filterChain(HttpSecurity http) throws Exception {
        http
            // Other security configurations
            .csrf().disable()
            .headers(headers -> headers
                .contentSecurityPolicy(csp -> csp
                    .policyDirectives(buildCspPolicy())
                )
                .frameOptions().deny()
                .xssProtection().block(true)
            );

        return http.build();
    }

    private String buildCspPolicy() {
        return String.join("; ",
            "default-src 'self'",
            "script-src 'self' 'nonce-{nonce}' https://trusted-cdn.com",
            "style-src 'self' 'unsafe-inline'",
            "img-src 'self' data: https:",
            "font-src 'self' https://fonts.gstatic.com",
            "connect-src 'self'",
            "object-src 'none'",
            "frame-ancestors 'none'",
            "base-uri 'self'",
            "form-action 'self'",
            "report-uri /api/security/csp-report"
        );
    }
}

3. Spring Boot with Custom Headers

import org.springframework.boot.web.servlet.FilterRegistrationBean;
import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import org.springframework.web.servlet.config.annotation.WebMvcConfigurer;

@Configuration
public class CspConfig implements WebMvcConfigurer {

    @Bean
    public FilterRegistrationBean<CspHeaderFilter> cspFilter() {
        FilterRegistrationBean<CspHeaderFilter> registrationBean = new FilterRegistrationBean<>();
        registrationBean.setFilter(new CspHeaderFilter());
        registrationBean.addUrlPatterns("/*");
        registrationBean.setOrder(1);
        return registrationBean;
    }
}

---

Advanced CSP Implementation

Nonce-based CSP for Dynamic Content

import javax.servlet.http.HttpServletRequest;
import java.security.SecureRandom;
import java.util.Base64;

public class NonceGenerator {

    private static final SecureRandom secureRandom = new SecureRandom();
    private static final Base64.Encoder base64Encoder = Base64.getEncoder();

    public static String generateNonce() {
        byte[] randomBytes = new byte[16];
        secureRandom.nextBytes(randomBytes);
        return base64Encoder.encodeToString(randomBytes);
    }

    public static String addNonceToCsp(String cspPolicy, String nonce) {
        return cspPolicy.replace("{nonce}", "'nonce-" + nonce + "'");
    }
}

// Enhanced CSP Filter with Nonce Support
public class NonceCspFilter implements Filter {

    @Override
    public void doFilter(ServletRequest request, ServletResponse response, 
                        FilterChain chain) throws IOException, ServletException {

        HttpServletRequest httpRequest = (HttpServletRequest) request;
        HttpServletResponse httpResponse = (HttpServletResponse) response;

        // Generate nonce for this request
        String nonce = NonceGenerator.generateNonce();

        // Store nonce in request for use in JSP/templates
        httpRequest.setAttribute("cspNonce", nonce);

        // Build CSP policy with nonce
        String cspPolicy = buildCspPolicy(nonce);
        httpResponse.setHeader("Content-Security-Policy", cspPolicy);

        chain.doFilter(request, response);
    }

    private String buildCspPolicy(String nonce) {
        return String.join("; ",
            "default-src 'self'",
            "script-src 'self' 'nonce-" + nonce + "' https://trusted-cdn.com",
            "style-src 'self' 'unsafe-inline'",
            "img-src 'self' data: https:",
            "font-src 'self'",
            "connect-src 'self'",
            "object-src 'none'",
            "frame-ancestors 'none'",
            "report-uri /api/csp-violation"
        );
    }
}

Using Nonce in JSP:

<script nonce="${cspNonce}">
    // This inline script will execute because it has a valid nonce
    console.log('Secure inline script');
</script>

<script src="https://trusted-cdn.com/library.js"></script>

---

CSP Violation Reporting

Violation Report Endpoint

import org.springframework.web.bind.annotation.*;
import javax.servlet.http.HttpServletRequest;
import java.io.BufferedReader;

@RestController
@RequestMapping("/api/security")
public class CspReportController {

    @PostMapping("/csp-report")
    public void handleCspViolation(HttpServletRequest request) {
        try {
            // Read the violation report
            StringBuilder reportBuilder = new StringBuilder();
            try (BufferedReader reader = request.getReader()) {
                String line;
                while ((line = reader.readLine()) != null) {
                    reportBuilder.append(line);
                }
            }

            String violationReport = reportBuilder.toString();

            // Log the violation (in production, send to monitoring system)
            logViolation(violationReport);

        } catch (Exception e) {
            // Don't throw exceptions from violation reports
            System.err.println("Error processing CSP violation: " + e.getMessage());
        }
    }

    private void logViolation(String violationReport) {
        // In production, send to your logging/monitoring system
        System.out.println("CSP Violation: " + violationReport);

        // Example: Send to log file, SIEM, or security monitoring service
        // logger.warn("CSP Violation detected: {}", violationReport);
    }
}

Violation Report Model

import com.fasterxml.jackson.annotation.JsonProperty;
import java.time.Instant;

public class CspViolationReport {

    @JsonProperty("csp-report")
    private CspReport cspReport;

    // Getters and setters
    public static class CspReport {
        private String documentUri;
        private String referrer;
        private String blockedUri;
        private String violatedDirective;
        private String effectiveDirective;
        private String originalPolicy;
        private String disposition;
        private String scriptSample;
        private int statusCode;
        private String sourceFile;
        private int lineNumber;
        private int columnNumber;

        // Getters and setters
        public String getDocumentUri() { return documentUri; }
        public void setDocumentUri(String documentUri) { this.documentUri = documentUri; }

        public String getBlockedUri() { return blockedUri; }
        public void setBlockedUri(String blockedUri) { this.blockedUri = blockedUri; }

        public String getViolatedDirective() { return violatedDirective; }
        public void setViolatedDirective(String violatedDirective) { this.violatedDirective = violatedDirective; }

        // ... other getters and setters
    }
}

---

Environment-Specific CSP Policies

public class CspPolicyBuilder {

    public enum Environment {
        DEVELOPMENT, STAGING, PRODUCTION
    }

    public static String buildPolicy(Environment env, String nonce) {
        switch (env) {
            case DEVELOPMENT:
                return buildDevelopmentPolicy(nonce);
            case STAGING:
                return buildStagingPolicy(nonce);
            case PRODUCTION:
                return buildProductionPolicy(nonce);
            default:
                return buildStrictPolicy(nonce);
        }
    }

    private static String buildDevelopmentPolicy(String nonce) {
        // More permissive for development
        return String.join("; ",
            "default-src 'self' 'unsafe-eval'",  // Allow eval for development
            "script-src 'self' 'unsafe-eval' 'nonce-" + nonce + "'",
            "style-src 'self' 'unsafe-inline'",
            "img-src 'self' data: https:",
            "connect-src 'self' ws: wss:",  // Allow WebSockets
            "font-src 'self'",
            "object-src 'none'",
            "frame-ancestors 'none'",
            "report-uri /api/csp-violation"
        );
    }

    private static String buildProductionPolicy(String nonce) {
        // Strict policy for production
        return String.join("; ",
            "default-src 'self'",
            "script-src 'self' 'nonce-" + nonce + "' https://cdn.example.com",
            "style-src 'self'",
            "img-src 'self' data: https:",
            "connect-src 'self' https://api.example.com",
            "font-src 'self'",
            "object-src 'none'",
            "frame-ancestors 'none'",
            "base-uri 'self'",
            "form-action 'self'",
            "report-uri /api/csp-violation"
        );
    }
}

---

Testing CSP Implementation

JUnit Test for CSP Headers

import org.junit.jupiter.api.Test;
import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.boot.test.autoconfigure.web.servlet.AutoConfigureMockMvc;
import org.springframework.boot.test.context.SpringBootTest;
import org.springframework.test.web.servlet.MockMvc;
import static org.springframework.test.web.servlet.request.MockMvcRequestBuilders.get;
import static org.springframework.test.web.servlet.result.MockMvcResultMatchers.header;

@SpringBootTest
@AutoConfigureMockMvc
public class CspHeaderTest {

    @Autowired
    private MockMvc mockMvc;

    @Test
    void testCspHeaderPresent() throws Exception {
        mockMvc.perform(get("/"))
            .andExpect(header().exists("Content-Security-Policy"))
            .andExpect(header().string("Content-Security-Policy", 
                org.hamcrest.Matchers.containsString("default-src 'self'")));
    }

    @Test
    void testCspHeaderContainsExpectedDirectives() throws Exception {
        mockMvc.perform(get("/"))
            .andExpect(header().string("Content-Security-Policy",
                org.hamcrest.Matchers.allOf(
                    org.hamcrest.Matchers.containsString("script-src"),
                    org.hamcrest.Matchers.containsString("style-src"),
                    org.hamcrest.Matchers.containsString("object-src 'none'")
                )));
    }
}

Integration Test for Violation Reporting

@Test
void testCspViolationReporting() throws Exception {
    String violationReport = """
        {
            "csp-report": {
                "document-uri": "https://example.com/page",
                "blocked-uri": "https://malicious.com/script.js",
                "violated-directive": "script-src",
                "original-policy": "script-src 'self'"
            }
        }
        """;

    mockMvc.perform(post("/api/security/csp-report")
            .contentType("application/csp-report")
            .content(violationReport))
        .andExpect(status().isOk());
}

---

Best Practices for CSP in Java

1. Start with Report-Only Mode:

// Use during development and testing
httpResponse.setHeader("Content-Security-Policy-Report-Only", cspPolicy);

2. Implement Progressive Security:

public class ProgressiveCspStrategy {
    public String getCspPolicy(HttpServletRequest request) {
        if (isNewUser(request)) {
            return buildPermissivePolicy(); // Learn what resources are needed
        } else {
            return buildStrictPolicy();     // Enforce strict policy
        }
    }
}

3. Use Nonces for Dynamic Content:

// Instead of 'unsafe-inline', use nonces for inline scripts/styles
"script-src 'self' 'nonce-RANDOM123'"

4. Monitor and Adapt:

@Component
public class CspViolationMonitor {

    @EventListener
    public void handleCspViolation(CspViolationEvent event) {
        // Analyze patterns and adjust policies
        if (isCommonFalsePositive(event)) {
            adjustPolicyForLegacyFeatures();
        }
    }
}

---

Common CSP Challenges and Solutions

Challenge 1: Third-party Widgets

// Solution: Allow specific third-party sources
String cspForThirdParty = String.join("; ",
    "default-src 'self'",
    "script-src 'self' https://widgets.example.com",
    "frame-src https://embed.example.com",
    "connect-src 'self' https://api.thirdparty.com"
);

Challenge 2: Legacy Applications

// Gradual implementation strategy
public class GradualCspFilter implements Filter {
    private int implementationPhase = 1;

    private String getPolicyForPhase() {
        switch (implementationPhase) {
            case 1: return buildReportOnlyPolicy();
            case 2: return buildPermissiveEnforcingPolicy();
            case 3: return buildStrictPolicy();
            default: return buildStrictPolicy();
        }
    }
}

---

Conclusion

Implementing Content Security Policy in Java applications provides a powerful defense against XSS and other code injection attacks. By following these practices:

• Start with reporting to identify needed resources
• Use nonces for dynamic content instead of unsafe-inline
• Implement environment-specific policies
• Monitor violations and continuously refine policies
• Use frameworks like Spring Security for consistent implementation

CSP significantly enhances your application's security posture. Remember that CSP is not a one-time setup but an ongoing process of monitoring, analysis, and policy refinement as your application evolves.