{"action":"created","comment":{"url":"https://api.github.com/repos/playframework/playframework/pulls/comments/179984981","pull_request_review_id":110325956,"id":179984981,"diff_hunk":"@@ -85,6 +85,35 @@ Like announced in the [[Play 2.6 Migration Guide|Migration26#Java-Form-Changes]]\n \n > **Important**: When upgrading to Play 2.7 you will not see any compiler warnings indicating that you have to migrate your `validate` methods (because Play executed them via reflection).\n \n+### SecurityHeadersFilter's contentSecurityPolicy deprecated for CSPFilter\n+\n+The [[SecurityHeaders filter|SecurityHeaders]] has a `contentSecurityPolicy` property in configuration is deprecated.  The functionality is still enabled, but `contentSecurityPolicy` property's default setting has been changed from `default-src ‘self’` to `null`.","path":"documentation/manual/releases/release27/migration27/Migration27.md","position":6,"original_position":6,"commit_id":"a65eb5828036e1db1bf081060358d329eba7a885","original_commit_id":"a65eb5828036e1db1bf081060358d329eba7a885","user":{"login":"wsargent","id":71236,"avatar_url":"https://avatars2.githubusercontent.com/u/71236?v=4","gravatar_id":"","url":"https://api.github.com/users/wsargent","html_url":"https://github.com/wsargent","followers_url":"https://api.github.com/users/wsargent/followers","following_url":"https://api.github.com/users/wsargent/following{/other_user}","gists_url":"https://api.github.com/users/wsargent/gists{/gist_id}","starred_url":"https://api.github.com/users/wsargent/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/wsargent/subscriptions","organizations_url":"https://api.github.com/users/wsargent/orgs","repos_url":"https://api.github.com/users/wsargent/repos","events_url":"https://api.github.com/users/wsargent/events{/privacy}","received_events_url":"https://api.github.com/users/wsargent/received_events","type":"User","site_admin":false},"body":"> The [[SecurityHeaders filter|SecurityHeaders]] has a `contentSecurityPolicy` property in configuration is deprecated \r\n\r\nis not the clearest wording either...","created_at":"2018-04-09T04:30:22Z","updated_at":"2018-04-09T04:30:22Z","html_url":"https://github.com/playframework/playframework/pull/8242#discussion_r179984981","pull_request_url":"https://api.github.com/repos/playframework/playframework/pulls/8242","author_association":"MEMBER","_links":{"self":{"href":"https://api.github.com/repos/playframework/playframework/pulls/comments/179984981"},"html":{"href":"https://github.com/playframework/playframework/pull/8242#discussion_r179984981"},"pull_request":{"href":"https://api.github.com/repos/playframework/playframework/pulls/8242"}},"in_reply_to_id":179966733},"pull_request":{"url":"https://api.github.com/repos/playframework/playframework/pulls/8242","id":170381681,"html_url":"https://github.com/playframework/playframework/pull/8242","diff_url":"https://github.com/playframework/playframework/pull/8242.diff","patch_url":"https://github.com/playframework/playframework/pull/8242.patch","issue_url":"https://api.github.com/repos/playframework/playframework/issues/8242","number":8242,"state":"open","locked":false,"title":"Content Security Policy Filter","user":{"login":"wsargent","id":71236,"avatar_url":"https://avatars2.githubusercontent.com/u/71236?v=4","gravatar_id":"","url":"https://api.github.com/users/wsargent","html_url":"https://github.com/wsargent","followers_url":"https://api.github.com/users/wsargent/followers","following_url":"https://api.github.com/users/wsargent/following{/other_user}","gists_url":"https://api.github.com/users/wsargent/gists{/gist_id}","starred_url":"https://api.github.com/users/wsargent/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/wsargent/subscriptions","organizations_url":"https://api.github.com/users/wsargent/orgs","repos_url":"https://api.github.com/users/wsargent/repos","events_url":"https://api.github.com/users/wsargent/events{/privacy}","received_events_url":"https://api.github.com/users/wsargent/received_events","type":"User","site_admin":false},"body":"Adds a Content Security Policy (CSP) filter / action that can inject nonce and CSP hashes in page templates\r\n\r\n* Set the security policy's contentSecurityPolicy to be null by default, rather than default-src 'self'. Anyone using CSP will have to override the setting to be useful, given how limiting 'self' is, and at that point they will receive a warning on start upsaying they should use CSPFilter.\r\n* Do not enable CSPFilter by default, but make sure it's mentioned prominently in filters. This means that things like Swagger will work out of the box. I don't like this, but I think it is no less secure in practice, since the first thing that anyone who has a CSP unexpectedly land on them is to disable it.\r\n* CSPFilter, when enabled, uses a strict nonce based policy by default -- this means a bunch of embedded script will break out of the box, but they explicitly signed up for that by enabling it.\r\n\r\n## Code\r\n\r\n* Breaks out the CSP portion of the SecurityHeadersFilter into its own filter.\r\n* Adds a nonce that carries through the filter via request attribute\r\n* Add Scala/Java CSPReport bodyparser and actions to show CSP policy violations in Play itself\r\n* Addition of nonces to default error pages (fixes https://github.com/playframework/playframework/issues/7662 / https://github.com/playframework/playframework/issues/8234  )\r\n* Add CSP hashes \r\n* Scala/Java API on compile time components\r\n* Action/Filter independent CSPProcessor\r\n* `+ nocsp` route modifier\r\n\r\n## Tests\r\n\r\n* Test for \"reportOnly\" feature\r\n* Testing on a hapless example project\r\n* Tests against Java action\r\n* Testing on actionbuilder and ad-hoc header creation\r\n* Testing for \"christmas tree\" CSP policy\r\n* Testing for valid CSP construction (against shape security)\r\n\r\n## Documentation\r\n\r\n* Documentation page on CSP Filter\r\n* Add hash calculator (example in documentation)\r\n* Document creating dynamic CSP on top of configuration\r\n* Highlights/Migration Guide from SecurityHeaders\r\n* Scaladoc everywhere\r\n* Migration explains why `play.mvc.Results.TODO` was moved to controller and turned into method\r\n\r\n## DEFERRED\r\n\r\n* Integration of allowed hosts into host whitelist\r\n* Integration into assets (assets digest is aware of asset.sha-256 file, provides as csp hash)","created_at":"2018-02-21T05:43:50Z","updated_at":"2018-04-09T04:30:22Z","closed_at":null,"merged_at":null,"merge_commit_sha":"98e4048b574d1df589cd6078a9a769e2cff61810","assignee":null,"assignees":[],"requested_reviewers":[],"requested_teams":[],"labels":[],"milestone":null,"commits_url":"https://api.github.com/repos/playframework/playframework/pulls/8242/commits","review_comments_url":"https://api.github.com/repos/playframework/playframework/pulls/8242/comments","review_comment_url":"https://api.github.com/repos/playframework/playframework/pulls/comments{/number}","comments_url":"https://api.github.com/repos/playframework/playframework/issues/8242/comments","statuses_url":"https://api.github.com/repos/playframework/playframework/statuses/a65eb5828036e1db1bf081060358d329eba7a885","head":{"label":"wsargent:better-content-security-policy-filter","ref":"better-content-security-policy-filter","sha":"a65eb5828036e1db1bf081060358d329eba7a885","user":{"login":"wsargent","id":71236,"avatar_url":"https://avatars2.githubusercontent.com/u/71236?v=4","gravatar_id":"","url":"https://api.github.com/users/wsargent","html_url":"https://github.com/wsargent","followers_url":"https://api.github.com/users/wsargent/followers","following_url":"https://api.github.com/users/wsargent/following{/other_user}","gists_url":"https://api.github.com/users/wsargent/gists{/gist_id}","starred_url":"https://api.github.com/users/wsargent/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/wsargent/subscriptions","organizations_url":"https://api.github.com/users/wsargent/orgs","repos_url":"https://api.github.com/users/wsargent/repos","events_url":"https://api.github.com/users/wsargent/events{/privacy}","received_events_url":"https://api.github.com/users/wsargent/received_events","type":"User","site_admin":false},"repo":{"id":11010009,"name":"playframework","full_name":"wsargent/playframework","owner":{"login":"wsargent","id":71236,"avatar_url":"https://avatars2.githubusercontent.com/u/71236?v=4","gravatar_id":"","url":"https://api.github.com/users/wsargent","html_url":"https://github.com/wsargent","followers_url":"https://api.github.com/users/wsargent/followers","following_url":"https://api.github.com/users/wsargent/following{/other_user}","gists_url":"https://api.github.com/users/wsargent/gists{/gist_id}","starred_url":"https://api.github.com/users/wsargent/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/wsargent/subscriptions","organizations_url":"https://api.github.com/users/wsargent/orgs","repos_url":"https://api.github.com/users/wsargent/repos","events_url":"https://api.github.com/users/wsargent/events{/privacy}","received_events_url":"https://api.github.com/users/wsargent/received_events","type":"User","site_admin":false},"private":false,"html_url":"https://github.com/wsargent/playframework","description":"Play framework 2.x","fork":true,"url":"https://api.github.com/repos/wsargent/playframework","forks_url":"https://api.github.com/repos/wsargent/playframework/forks","keys_url":"https://api.github.com/repos/wsargent/playframework/keys{/key_id}","collaborators_url":"https://api.github.com/repos/wsargent/playframework/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/wsargent/playframework/teams","hooks_url":"https://api.github.com/repos/wsargent/playframework/hooks","issue_events_url":"https://api.github.com/repos/wsargent/playframework/issues/events{/number}","events_url":"https://api.github.com/repos/wsargent/playframework/events","assignees_url":"https://api.github.com/repos/wsargent/playframework/assignees{/user}","branches_url":"https://api.github.com/repos/wsargent/playframework/branches{/branch}","tags_url":"https://api.github.com/repos/wsargent/playframework/tags","blobs_url":"https://api.github.com/repos/wsargent/playframework/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/wsargent/playframework/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/wsargent/playframework/git/refs{/sha}","trees_url":"https://api.github.com/repos/wsargent/playframework/git/trees{/sha}","statuses_url":"https://api.github.com/repos/wsargent/playframework/statuses/{sha}","languages_url":"https://api.github.com/repos/wsargent/playframework/languages","stargazers_url":"https://api.github.com/repos/wsargent/playframework/stargazers","contributors_url":"https://api.github.com/repos/wsargent/playframework/contributors","subscribers_url":"https://api.github.com/repos/wsargent/playframework/subscribers","subscription_url":"https://api.github.com/repos/wsargent/playframework/subscription","commits_url":"https://api.github.com/repos/wsargent/playframework/commits{/sha}","git_commits_url":"https://api.github.com/repos/wsargent/playframework/git/commits{/sha}","comments_url":"https://api.github.com/repos/wsargent/playframework/comments{/number}","issue_comment_url":"https://api.github.com/repos/wsargent/playframework/issues/comments{/number}","contents_url":"https://api.github.com/repos/wsargent/playframework/contents/{+path}","compare_url":"https://api.github.com/repos/wsargent/playframework/compare/{base}...{head}","merges_url":"https://api.github.com/repos/wsargent/playframework/merges","archive_url":"https://api.github.com/repos/wsargent/playframework/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/wsargent/playframework/downloads","issues_url":"https://api.github.com/repos/wsargent/playframework/issues{/number}","pulls_url":"https://api.github.com/repos/wsargent/playframework/pulls{/number}","milestones_url":"https://api.github.com/repos/wsargent/playframework/milestones{/number}","notifications_url":"https://api.github.com/repos/wsargent/playframework/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/wsargent/playframework/labels{/name}","releases_url":"https://api.github.com/repos/wsargent/playframework/releases{/id}","deployments_url":"https://api.github.com/repos/wsargent/playframework/deployments","created_at":"2013-06-27T22:58:23Z","updated_at":"2015-04-15T18:06:45Z","pushed_at":"2018-04-06T16:20:04Z","git_url":"git://github.com/wsargent/playframework.git","ssh_url":"git@github.com:wsargent/playframework.git","clone_url":"https://github.com/wsargent/playframework.git","svn_url":"https://github.com/wsargent/playframework","homepage":"http://www.playframework.org/","size":87133,"stargazers_count":3,"watchers_count":3,"language":"Scala","has_issues":false,"has_projects":true,"has_downloads":true,"has_wiki":false,"has_pages":false,"forks_count":1,"mirror_url":null,"archived":false,"open_issues_count":0,"license":{"key":"apache-2.0","name":"Apache License 2.0","spdx_id":"Apache-2.0","url":"https://api.github.com/licenses/apache-2.0"},"forks":1,"open_issues":0,"watchers":3,"default_branch":"master"}},"base":{"label":"playframework:master","ref":"master","sha":"386b52aec425a85234ad3c3c5429c2002642bc66","user":{"login":"playframework","id":319107,"avatar_url":"https://avatars0.githubusercontent.com/u/319107?v=4","gravatar_id":"","url":"https://api.github.com/users/playframework","html_url":"https://github.com/playframework","followers_url":"https://api.github.com/users/playframework/followers","following_url":"https://api.github.com/users/playframework/following{/other_user}","gists_url":"https://api.github.com/users/playframework/gists{/gist_id}","starred_url":"https://api.github.com/users/playframework/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/playframework/subscriptions","organizations_url":"https://api.github.com/users/playframework/orgs","repos_url":"https://api.github.com/users/playframework/repos","events_url":"https://api.github.com/users/playframework/events{/privacy}","received_events_url":"https://api.github.com/users/playframework/received_events","type":"Organization","site_admin":false},"repo":{"id":2340549,"name":"playframework","full_name":"playframework/playframework","owner":{"login":"playframework","id":319107,"avatar_url":"https://avatars0.githubusercontent.com/u/319107?v=4","gravatar_id":"","url":"https://api.github.com/users/playframework","html_url":"https://github.com/playframework","followers_url":"https://api.github.com/users/playframework/followers","following_url":"https://api.github.com/users/playframework/following{/other_user}","gists_url":"https://api.github.com/users/playframework/gists{/gist_id}","starred_url":"https://api.github.com/users/playframework/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/playframework/subscriptions","organizations_url":"https://api.github.com/users/playframework/orgs","repos_url":"https://api.github.com/users/playframework/repos","events_url":"https://api.github.com/users/playframework/events{/privacy}","received_events_url":"https://api.github.com/users/playframework/received_events","type":"Organization","site_admin":false},"private":false,"html_url":"https://github.com/playframework/playframework","description":"Play Framework","fork":false,"url":"https://api.github.com/repos/playframework/playframework","forks_url":"https://api.github.com/repos/playframework/playframework/forks","keys_url":"https://api.github.com/repos/playframework/playframework/keys{/key_id}","collaborators_url":"https://api.github.com/repos/playframework/playframework/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/playframework/playframework/teams","hooks_url":"https://api.github.com/repos/playframework/playframework/hooks","issue_events_url":"https://api.github.com/repos/playframework/playframework/issues/events{/number}","events_url":"https://api.github.com/repos/playframework/playframework/events","assignees_url":"https://api.github.com/repos/playframework/playframework/assignees{/user}","branches_url":"https://api.github.com/repos/playframework/playframework/branches{/branch}","tags_url":"https://api.github.com/repos/playframework/playframework/tags","blobs_url":"https://api.github.com/repos/playframework/playframework/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/playframework/playframework/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/playframework/playframework/git/refs{/sha}","trees_url":"https://api.github.com/repos/playframework/playframework/git/trees{/sha}","statuses_url":"https://api.github.com/repos/playframework/playframework/statuses/{sha}","languages_url":"https://api.github.com/repos/playframework/playframework/languages","stargazers_url":"https://api.github.com/repos/playframework/playframework/stargazers","contributors_url":"https://api.github.com/repos/playframework/playframework/contributors","subscribers_url":"https://api.github.com/repos/playframework/playframework/subscribers","subscription_url":"https://api.github.com/repos/playframework/playframework/subscription","commits_url":"https://api.github.com/repos/playframework/playframework/commits{/sha}","git_commits_url":"https://api.github.com/repos/playframework/playframework/git/commits{/sha}","comments_url":"https://api.github.com/repos/playframework/playframework/comments{/number}","issue_comment_url":"https://api.github.com/repos/playframework/playframework/issues/comments{/number}","contents_url":"https://api.github.com/repos/playframework/playframework/contents/{+path}","compare_url":"https://api.github.com/repos/playframework/playframework/compare/{base}...{head}","merges_url":"https://api.github.com/repos/playframework/playframework/merges","archive_url":"https://api.github.com/repos/playframework/playframework/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/playframework/playframework/downloads","issues_url":"https://api.github.com/repos/playframework/playframework/issues{/number}","pulls_url":"https://api.github.com/repos/playframework/playframework/pulls{/number}","milestones_url":"https://api.github.com/repos/playframework/playframework/milestones{/number}","notifications_url":"https://api.github.com/repos/playframework/playframework/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/playframework/playframework/labels{/name}","releases_url":"https://api.github.com/repos/playframework/playframework/releases{/id}","deployments_url":"https://api.github.com/repos/playframework/playframework/deployments","created_at":"2011-09-07T09:24:08Z","updated_at":"2018-04-09T02:19:00Z","pushed_at":"2018-04-09T00:49:41Z","git_url":"git://github.com/playframework/playframework.git","ssh_url":"git@github.com:playframework/playframework.git","clone_url":"https://github.com/playframework/playframework.git","svn_url":"https://github.com/playframework/playframework","homepage":"http://www.playframework.com/","size":88992,"stargazers_count":10322,"watchers_count":10322,"language":"Scala","has_issues":true,"has_projects":false,"has_downloads":true,"has_wiki":false,"has_pages":false,"forks_count":3510,"mirror_url":null,"archived":false,"open_issues_count":368,"license":{"key":"apache-2.0","name":"Apache License 2.0","spdx_id":"Apache-2.0","url":"https://api.github.com/licenses/apache-2.0"},"forks":3510,"open_issues":368,"watchers":10322,"default_branch":"master"}},"_links":{"self":{"href":"https://api.github.com/repos/playframework/playframework/pulls/8242"},"html":{"href":"https://github.com/playframework/playframework/pull/8242"},"issue":{"href":"https://api.github.com/repos/playframework/playframework/issues/8242"},"comments":{"href":"https://api.github.com/repos/playframework/playframework/issues/8242/comments"},"review_comments":{"href":"https://api.github.com/repos/playframework/playframework/pulls/8242/comments"},"review_comment":{"href":"https://api.github.com/repos/playframework/playframework/pulls/comments{/number}"},"commits":{"href":"https://api.github.com/repos/playframework/playframework/pulls/8242/commits"},"statuses":{"href":"https://api.github.com/repos/playframework/playframework/statuses/a65eb5828036e1db1bf081060358d329eba7a885"}},"author_association":"MEMBER"}}
{"actor":{"display_login":"wsargent"}}