Does primefaces meet CSP level 3 requirement

UI Components for JSF
Post Reply
Kelvinmak
Posts: 2
Joined: 29 Oct 2020, 04:02

01 Dec 2021, 04:42

Hi, the latest version of Chrome, Firefox and Edge support CSP level 3. Primefaces CSP implementation using "nonce" is only CSP level 2.

After I enabled the CSP in Primefaces which added the nonce, our application is still locked by the browsers.

Is there any other solution to fix it?

tandraschko
PrimeFaces Core Developer
Posts: 3903
Joined: 03 Dec 2010, 14:11
Location: Bavaria, DE
Contact:

01 Dec 2021, 14:01

i dont think so, nonce was the only way to add CSP to JSF/PrimeFaces without rewriting everything :D
Thomas Andraschko

PrimeFaces | PrimeFaces Extensions

Apache Member | OpenWebBeans, DeltaSpike, MyFaces, BVal, TomEE

Sponsor me: https://github.com/sponsors/tandraschko
Blog: http://tandraschko.blogspot.de/
Twitter: https://twitter.com/TAndraschko

Melloware
Posts: 2974
Joined: 22 Apr 2013, 15:48

01 Dec 2021, 20:11

When you say locked by browsers what do you mean? I am using PrimeFaces CSP in Production and its working in all majors browsers right now at CSP level 2.
PrimeFaces Developer | PrimeFaces Extensions Developer
GitHub Profile: https://github.com/melloware
PrimeFaces Elite 11.0.0 / PF Extensions 11.0.0
PrimeReact 7.1.0

Post Reply

Return to “PrimeFaces”

  • Information
  • Who is online

    Users browsing this forum: No registered users and 19 guests