dashorst opened a new issue, #1660:
URL: https://github.com/apache/wicket/issues/1660
`WebApplication.internalInit()` does this:
```java
if (getConfigurationType() == RuntimeConfigurationType.DEVELOPMENT)
{
...
getCspSettings().blocking().reportBack();
}
getCspSettings().blocking().strict();
```
`CSPHeaderConfiguration.strict()` starts with `clear()`, so it removes the
`report-uri` that `reportBack()` added a line earlier. In development mode the
Content Security Policy header therefore never carries a `report-uri`, and
violations are not reported back to the application, although that is clearly
the intent. Same code on master and wicket-10.x.
Proposed fix: call `strict()` first and `reportBack()` after it, and add a
test that a development-mode application sends a `report-uri`.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
