tree 59a7b678f5cb7d4813667f7f97f2202ebe397185
parent b07bdd9003b7a549fda5c913773d93861a4f545e
author Kamil Musin <kamilm@google.com> 1670597327 +0100
committer Kamil Musin <kamilm@google.com> 1670840173 +0100

Provide csp_nonce to Soy Templates

The CSP nonce is only provided if available. If a filter is installed
that attaches "nonce" attribute to request. For example in google
deployment of gerrit we have such filter that sets nonce on all requests
before they are processed by a servelet.

CSP helps protects sites from XSS attacks. On Google hosts we set CSP
headers that require all script elements to be accompanied by nonce (per
request generated random string). Soy templates have a built in support
for attaching nonce, as long as the value is provided using Inject Data
mechanism.

Google-Bud-Id: b/33429040
Release-Notes: skip
Change-Id: Ifa3a07b8c77918a8a4ab48775b68e4f3b39bd3cb