strojure.ring-lib.middleware.csp — com.github.strojure/ring-lib 1.2.1-55

Ring middleware to add CSP header in response.

report-uri-default clj

Default value of the CSP report URI.

wrap-csp clj

(wrap-csp handler {:keys [policy report-only random-nonce-fn report-callback]})

Adds CSP header in ring response. If header uses nonce then :csp-nonce key is being added in ring request to be used in response body.

Configuration params:

• :policy – a map of directive names (string, keyword) and directive values (string, keyword, collection of strings and keywords)

  • The :nonce keyword in directive values represents nonce placeholder

• :report-only – optional boolean flag if report-only CSP header name should be used.

• :random-nonce-fn – optional 0-arity function to generate nonce for every request.

• :report-callback – a function (fn callback [request] ...) to handle report-uri directive.

  • When presented then handler is wrapped with wrap-report-uri.
  • If policy map does not have report-uri directive then it is added with default value "/csp-report".

Static header example:

(def -handler (-> (fn [_] {}) (wrap-csp {:policy {:default-src :none}})))

(-handler {})
:=> {:headers {"Content-Security-Policy" "default-src 'none'"}}

Example header with nonce:

(def -handler (-> (fn [_] {}) (wrap-csp {:policy {:script-src :nonce}})))

(-handler {})
:=> {:headers {"Content-Security-Policy" "script-src 'nonce-k6JADK2qxoFO4bfKnZI0vyZv'"}}

wrap-report-uri clj

(wrap-report-uri handler {:keys [report-callback report-uri]})

Handles CSP report URI and invokes :report-callback function with ring request as argument. Respond with {:status 200}. Used by wrap-csp when :report-callback option is defined.

Configuration params:

• :report-callback – a function (fn callback [request] ...).

  • Required.
  • Invoked when request :uri is report URI
  • Callback should read CSP report JSON from the request :body stream itself.
  • The return value is ignored.

• :report-uri – a string with request :uri to match for.

  • Exact value is matched.
  • Default value is "/csp-report".