Support nonce-based Content Security Policy

config/src/main/java/org/springframework/security/config/annotation/web/configurers/HeadersConfigurer.java

@@ -18,16 +18,19 @@
 
 import java.net.URI;
 import java.util.ArrayList;
+import java.util.Arrays;
 import java.util.List;
 import java.util.Map;
 
 import jakarta.servlet.http.HttpServletRequest;
+import org.jspecify.annotations.Nullable;
 
 import org.springframework.security.config.Customizer;
 import org.springframework.security.config.annotation.configuration.ObjectPostProcessorConfiguration;
 import org.springframework.security.config.annotation.web.HttpSecurityBuilder;
 import org.springframework.security.config.annotation.web.builders.HttpSecurity;
 import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
+import org.springframework.security.web.header.ContentSecurityPolicyNonceGeneratingFilter;
 import org.springframework.security.web.header.HeaderWriter;
 import org.springframework.security.web.header.HeaderWriterFilter;
 import org.springframework.security.web.header.writers.CacheControlHeadersWriter;
@@ -45,6 +48,8 @@
 import org.springframework.security.web.header.writers.XXssProtectionHeaderWriter;
 import org.springframework.security.web.header.writers.frameoptions.XFrameOptionsHeaderWriter;
 import org.springframework.security.web.header.writers.frameoptions.XFrameOptionsHeaderWriter.XFrameOptionsMode;
+import org.springframework.security.web.servlet.util.matcher.PathPatternRequestMatcher;
+import org.springframework.security.web.util.matcher.OrRequestMatcher;
 import org.springframework.security.web.util.matcher.RequestMatcher;
 import org.springframework.util.Assert;
 
@@ -75,6 +80,7 @@
  * @author Vedran Pavic
  * @author Ankur Pathak
  * @author Daniel Garnier-Moiroux
+ * @author Ziqin Wang
  * @since 3.2
  */
 public class HeadersConfigurer<H extends HttpSecurityBuilder<H>>
@@ -246,6 +252,7 @@ public HeadersConfigurer<H> httpPublicKeyPinning(Customizer<HpkpConfig> hpkpCust
 	public HeadersConfigurer<H> contentSecurityPolicy(
 			Customizer<ContentSecurityPolicyConfig> contentSecurityCustomizer) {
 		this.contentSecurityPolicy.writer = new ContentSecurityPolicyHeaderWriter();
+		this.contentSecurityPolicy.nonceGeneratingFilter = new ContentSecurityPolicyNonceGeneratingFilter();
 		contentSecurityCustomizer.customize(this.contentSecurityPolicy);
 		return HeadersConfigurer.this;
 	}
@@ -273,6 +280,10 @@ public HeadersConfigurer<H> defaultsDisabled() {
 	public void configure(H http) {
 		HeaderWriterFilter headersFilter = createHeaderWriterFilter();
 		http.addFilter(headersFilter);
+		// nonceGeneratingFilter is instantiated iff CSP is configured
+		if (this.contentSecurityPolicy.nonceGeneratingFilter != null) {
+			http.addFilterBefore(this.contentSecurityPolicy.nonceGeneratingFilter, HeaderWriterFilter.class);
+		}
 	}
 
 	/**
@@ -937,11 +948,17 @@ public final class ContentSecurityPolicyConfig {
 
 		private ContentSecurityPolicyHeaderWriter writer;
 
+		private ContentSecurityPolicyNonceGeneratingFilter nonceGeneratingFilter;
+
+		private @Nullable RequestMatcher requestMatcher;
+
 		private ContentSecurityPolicyConfig() {
 		}
 
 		/**
-		 * Sets the security policy directive(s) to be used in the response header.
+		 * Sets the security policy directive(s) to be used in the response header. The
+		 * {@code policyDirectives} may contain {@code {nonce}} as placeholders for a
+		 * generated secure random nonce, e.g., {@code script-src 'self' 'nonce-{nonce}'}.
 		 * @param policyDirectives the security policy directive(s)
 		 * @return the {@link ContentSecurityPolicyConfig} for additional configuration
 		 * @throws IllegalArgumentException if policyDirectives is null or empty
@@ -961,6 +978,61 @@ public ContentSecurityPolicyConfig reportOnly() {
 			return this;
 		}
 
+		/**
+		 * Sets the name of the servlet request attribute for the generated nonce. Views
+		 * can read this attribute to render the nonce in HTML.
+		 * @param nonceAttributeName the name of the nonce attribute
+		 * @return the {@link ContentSecurityPolicyConfig} for additional configuration
+		 * @throws IllegalArgumentException if {@code nonceAttributeName} is {@code null}
+		 * or empty
+		 * @since 7.2
+		 */
+		public ContentSecurityPolicyConfig nonceAttributeName(String nonceAttributeName) {
+			Assert.hasLength(nonceAttributeName, "NonceAttributeName must not be null or empty");
+			this.nonceGeneratingFilter.setAttributeName(nonceAttributeName);
+			return this;
+		}
+
+		/**
+		 * Specifies the {@link RequestMatcher} to use for determining when CSP should be
+		 * applied. The default is to enable CSP in every response if
+		 * {@link HeadersConfigurer#contentSecurityPolicy(Customizer)} is configured.
+		 * @param requestMatcher the {@link RequestMatcher} to use
+		 * @return the {@link ContentSecurityPolicyConfig} for additional configuration
+		 * @throws IllegalArgumentException if {@code requestMatcher} is null
+		 * @throws IllegalStateException if a {@link RequestMatcher} is already configured
+		 * by a previous call of this method or {@link #requestMatchers(String...)}
+		 * @since 7.2
+		 * @see #requestMatchers(String...)
+		 */
+		public ContentSecurityPolicyConfig requestMatcher(RequestMatcher requestMatcher) {
+			Assert.notNull(requestMatcher, "RequestMatcher cannot be null");
+			Assert.state(this.requestMatcher == null, "RequestMatcher(s) is already configured");
+			this.writer.setRequestMatcher(requestMatcher);
+			this.requestMatcher = requestMatcher;
+			return this;
+		}
+
+		/**
+		 * Specifies the matching path patterns for determining when CSP should be
+		 * applied. The default is to enable CSP in every response if
+		 * {@link HeadersConfigurer#contentSecurityPolicy(Customizer)} is configured.
+		 * @param pathPatterns the path patterns to be matched with a
+		 * {@link PathPatternRequestMatcher}
+		 * @return the {@link ContentSecurityPolicyConfig} for additional configuration
+		 * @throws IllegalArgumentException if any path pattern if rejected by
+		 * {@link PathPatternRequestMatcher.Builder#matcher(String)}
+		 * @throws IllegalStateException if a {@link RequestMatcher} is already configured
+		 * by a previous call of this method or {@link #requestMatcher(RequestMatcher)}
+		 * @since 7.2
+		 * @see #requestMatcher(RequestMatcher)
+		 */
+		public ContentSecurityPolicyConfig requestMatchers(String... pathPatterns) {
+			PathPatternRequestMatcher.Builder builder = HeadersConfigurer.this.getRequestMatcherBuilder();
+			OrRequestMatcher matcher = new OrRequestMatcher(Arrays.stream(pathPatterns).map(builder::matcher).toList());
+			return this.requestMatcher(matcher);
+		}
+
 	}
 
 	public final class ReferrerPolicyConfig {

config/src/main/java/org/springframework/security/config/http/HeadersBeanDefinitionParser.java

@@ -33,6 +33,7 @@
 import org.springframework.beans.factory.support.ManagedList;
 import org.springframework.beans.factory.xml.BeanDefinitionParser;
 import org.springframework.beans.factory.xml.ParserContext;
+import org.springframework.security.web.header.ContentSecurityPolicyNonceGeneratingFilter;
 import org.springframework.security.web.header.HeaderWriterFilter;
 import org.springframework.security.web.header.writers.CacheControlHeadersWriter;
 import org.springframework.security.web.header.writers.ContentSecurityPolicyHeaderWriter;
@@ -54,6 +55,7 @@
 import org.springframework.security.web.header.writers.frameoptions.XFrameOptionsHeaderWriter;
 import org.springframework.util.StringUtils;
 import org.springframework.util.xml.DomUtils;
+import org.springframework.web.filter.CompositeFilter;
 
 /**
  * Parser for the {@code HeadersFilter}.
@@ -133,6 +135,8 @@ public class HeadersBeanDefinitionParser implements BeanDefinitionParser {
 
 	private ManagedList<BeanMetadataElement> headerWriters;
 
+	private BeanDefinition nonceGeneratingFilter;
+
 	@Override
 	public BeanDefinition parse(Element element, ParserContext parserContext) {
 		this.headerWriters = new ManagedList<>();
@@ -164,7 +168,13 @@ else if (noWriters) {
 			return null;
 		}
 		builder.addConstructorArgValue(this.headerWriters);
-		return builder.getBeanDefinition();
+		BeanDefinition headerWriterFilter = builder.getBeanDefinition();
+		if (this.nonceGeneratingFilter == null) {
+			return headerWriterFilter;
+		}
+		return BeanDefinitionBuilder.rootBeanDefinition(CompositeFilter.class)
+			.addPropertyValue("filters", ManagedList.of(this.nonceGeneratingFilter, headerWriterFilter))
+			.getBeanDefinition();
 	}
 
 	/**
@@ -323,6 +333,9 @@ private void addContentSecurityPolicy(Element contentSecurityPolicyElement, Pars
 			headersWriter.addPropertyValue("reportOnly", reportOnly);
 		}
 		this.headerWriters.add(headersWriter.getBeanDefinition());
+		this.nonceGeneratingFilter = BeanDefinitionBuilder
+			.rootBeanDefinition(ContentSecurityPolicyNonceGeneratingFilter.class)
+			.getBeanDefinition();
 	}
 
 	private void parseReferrerPolicyElement(Element element, ParserContext context) {

config/src/main/java/org/springframework/security/config/web/server/ServerHttpSecurity.java

@@ -37,6 +37,7 @@
 
 import org.apache.commons.logging.Log;
 import org.apache.commons.logging.LogFactory;
+import org.jspecify.annotations.Nullable;
 import reactor.core.publisher.Mono;
 import reactor.util.context.Context;
 
@@ -183,6 +184,7 @@
 import org.springframework.security.web.server.csrf.WebSessionServerCsrfTokenRepository;
 import org.springframework.security.web.server.header.CacheControlServerHttpHeadersWriter;
 import org.springframework.security.web.server.header.CompositeServerHttpHeadersWriter;
+import org.springframework.security.web.server.header.ContentSecurityPolicyNonceGeneratingWebFilter;
 import org.springframework.security.web.server.header.ContentSecurityPolicyServerHttpHeadersWriter;
 import org.springframework.security.web.server.header.ContentTypeOptionsServerHttpHeadersWriter;
 import org.springframework.security.web.server.header.CrossOriginEmbedderPolicyServerHttpHeadersWriter;
@@ -2452,6 +2454,7 @@ protected void configure(ServerHttpSecurity http) {
 	 * Configures HTTP Response Headers.
 	 *
 	 * @author Rob Winch
+	 * @author Ziqin Wang
 	 * @since 5.0
 	 * @see #headers(Customizer)
 	 */
@@ -2483,6 +2486,8 @@ public final class HeaderSpec {
 
 		private CrossOriginResourcePolicyServerHttpHeadersWriter crossOriginResourcePolicy = new CrossOriginResourcePolicyServerHttpHeadersWriter();
 
+		private ContentSecurityPolicyNonceGeneratingWebFilter nonceGeneratingFilter;
+
 		private HeaderSpec() {
 			this.writers = new ArrayList<>(Arrays.asList(this.cacheControl, this.contentTypeOptions, this.hsts,
 					this.frameOptions, this.xss, this.featurePolicy, this.permissionsPolicy, this.contentSecurityPolicy,
@@ -2560,6 +2565,10 @@ protected void configure(ServerHttpSecurity http) {
 			ServerHttpHeadersWriter writer = new CompositeServerHttpHeadersWriter(this.writers);
 			HttpHeaderWriterWebFilter result = new HttpHeaderWriterWebFilter(writer);
 			http.addFilterAt(result, SecurityWebFiltersOrder.HTTP_HEADERS_WRITER);
+			// nonceGeneratingFilter is instantiated iff CSP is configured
+			if (this.nonceGeneratingFilter != null) {
+				http.addFilterBefore(this.nonceGeneratingFilter, SecurityWebFiltersOrder.HTTP_HEADERS_WRITER);
+			}
 		}
 
 		/**
@@ -2836,8 +2845,11 @@ public final class ContentSecurityPolicySpec {
 
 			private static final String DEFAULT_SRC_SELF_POLICY = "default-src 'self'";
 
+			private @Nullable ServerWebExchangeMatcher exchangeMatcher;
+
 			private ContentSecurityPolicySpec() {
 				HeaderSpec.this.contentSecurityPolicy.setPolicyDirectives(DEFAULT_SRC_SELF_POLICY);
+				HeaderSpec.this.nonceGeneratingFilter = new ContentSecurityPolicyNonceGeneratingWebFilter();
 			}
 
 			/**
@@ -2854,6 +2866,9 @@ public HeaderSpec reportOnly(boolean reportOnly) {
 
 			/**
 			 * Sets the security policy directive(s) to be used in the response header.
+			 * The {@code policyDirectives} may contain {@code {nonce}} as placeholders
+			 * for a generated secure random nonce, e.g., {@code script-src 'self'
+			 * 'nonce-{nonce}'}.
 			 * @param policyDirectives the security policy directive(s)
 			 * @return the {@link HeaderSpec} to continue configuring
 			 */
@@ -2862,8 +2877,60 @@ public HeaderSpec policyDirectives(String policyDirectives) {
 				return HeaderSpec.this;
 			}
 
-			private ContentSecurityPolicySpec(String policyDirectives) {
-				HeaderSpec.this.contentSecurityPolicy.setPolicyDirectives(policyDirectives);
+			/**
+			 * Sets the name of the {@link ServerWebExchange#getAttribute(String) exchange
+			 * attribute} for the generated nonce. Views can read this attribute to render
+			 * the nonce in HTML.
+			 * @param nonceAttributeName the name of the nonce attribute
+			 * @return the {@link ContentSecurityPolicySpec} to continue configuring
+			 * @throws IllegalArgumentException if {@code nonceAttributeName} is
+			 * {@code null} or empty
+			 * @since 7.2
+			 */
+			public ContentSecurityPolicySpec nonceAttributeName(String nonceAttributeName) {
+				Assert.hasLength(nonceAttributeName, "NonceAttributeName must not be null or empty");
+				HeaderSpec.this.nonceGeneratingFilter.setAttributeName(nonceAttributeName);
+				return this;
+			}
+
+			/**
+			 * Specifies the {@link ServerWebExchangeMatcher} to use for determining when
+			 * CSP should be applied. The default is to enable CSP in every response if
+			 * {@link HeaderSpec#contentSecurityPolicy(Customizer)} is configured.
+			 * @param matcher the {@link ServerWebExchangeMatcher} to use
+			 * @return the {@link ContentSecurityPolicySpec} to continue configuring
+			 * @throws IllegalArgumentException if {@code matcher} is {@code null}
+			 * @throws IllegalStateException if a {@link ServerWebExchangeMatcher} is
+			 * already configured by a previous call of this method or
+			 * {@link #exchangeMatchers(String...)}
+			 * @since 7.2
+			 * @see #exchangeMatchers(String...)
+			 */
+			public ContentSecurityPolicySpec exchangeMatcher(ServerWebExchangeMatcher matcher) {
+				Assert.notNull(matcher, "Matcher must not be null");
+				Assert.state(this.exchangeMatcher == null, "ExchangeMatcher(s) is already configured");
+				HeaderSpec.this.contentSecurityPolicy.setExchangeMatcher(matcher);
+				this.exchangeMatcher = matcher;
+				return this;
+			}
+
+			/**
+			 * Specifies the matching path patterns for determining when CSP should be
+			 * applied. The default is to enable CSP in every response if
+			 * {@link HeaderSpec#contentSecurityPolicy(Customizer)} is configured.
+			 * @param pathPatterns the path patterns to be matched with a
+			 * {@link PathPatternParserServerWebExchangeMatcher}
+			 * @return the {@link ContentSecurityPolicySpec} to continue configuring
+			 * @throws IllegalArgumentException if any path pattern is rejected by
+			 * {@link PathPatternParserServerWebExchangeMatcher}
+			 * @throws IllegalStateException if a {@link ServerWebExchangeMatcher} is
+			 * already configured by a previous call of this method or
+			 * {@link #exchangeMatcher(ServerWebExchangeMatcher)}
+			 * @since 7.2
+			 * @see #exchangeMatcher(ServerWebExchangeMatcher)
+			 */
+			public ContentSecurityPolicySpec exchangeMatchers(String... pathPatterns) {
+				return this.exchangeMatcher(ServerWebExchangeMatchers.pathMatchers(pathPatterns));
 			}
 
 		}

config/src/main/kotlin/org/springframework/security/config/annotation/web/headers/ContentSecurityPolicyDsl.kt

@@ -18,21 +18,63 @@ package org.springframework.security.config.annotation.web.headers
 
 import org.springframework.security.config.annotation.web.builders.HttpSecurity
 import org.springframework.security.config.annotation.web.configurers.HeadersConfigurer
+import org.springframework.security.web.util.matcher.RequestMatcher
 
 /**
  * A Kotlin DSL to configure the [HttpSecurity] Content-Security-Policy header using
  * idiomatic Kotlin code.
  *
  * @author Eleftheria Stein
+ * @author Ziqin Wang
  * @since 5.3
- * @property policyDirectives the security policy directive(s) to be used in the response header.
- * @property reportOnly includes the Content-Security-Policy-Report-Only header in the response.
  */
 @HeadersSecurityMarker
 class ContentSecurityPolicyDsl {
+    /**
+     * The security policy directive(s) to be used in the response header.
+     * The [policyDirectives] may contain `{nonce}` as placeholders for a generated secure
+     * random nonce, e.g., `script-src 'self' 'nonce-{nonce}'`.
+     */
     var policyDirectives: String? = null
+
+    /** Includes the `Content-Security-Policy-Report-Only` header in the response. */
     var reportOnly: Boolean? = null
 
+    /**
+     * The name of the servlet request attribute for the generated nonce. Views can read
+     * this attribute to render the nonce in HTML.
+     * @since 7.2
+     */
+    var nonceAttributeName: String? = null
+
+    /**
+     * The [RequestMatcher] to use for determining when CSP should be applied.
+     * The default is to enable CSP in every response if
+     * [org.springframework.security.config.annotation.web.HeadersDsl.contentSecurityPolicy]
+     * is configured.
+     * You can configure either this property or [requestMatchers], but not both.
+     * @since 7.2
+     * @see requestMatchers
+     */
+    var requestMatcher: RequestMatcher? = null
+
+    private var requireCspPathPatterns: Array<out String>? = null
+
+    /**
+     * Specify the matching path patterns for determining when CSP should be applied.
+     * The default is to write CSP header in every response if
+     * [org.springframework.security.config.annotation.web.HeadersDsl.contentSecurityPolicy]
+     * is configured.
+     * You can configure either this method or [requestMatcher], but not both.
+     * @param pathPatterns the path patterns to be matched with a
+     * [org.springframework.security.web.servlet.util.matcher.PathPatternRequestMatcher]
+     * @since 7.2
+     * @see requestMatcher
+     */
+    fun requestMatchers(vararg pathPatterns: String) {
+        requireCspPathPatterns = pathPatterns
+    }
+
     internal fun get(): (HeadersConfigurer<HttpSecurity>.ContentSecurityPolicyConfig) -> Unit {
         return { contentSecurityPolicy ->
             policyDirectives?.also {
@@ -43,6 +85,9 @@ class ContentSecurityPolicyDsl {
                     contentSecurityPolicy.reportOnly()
                 }
             }
+            nonceAttributeName?.also(contentSecurityPolicy::nonceAttributeName)
+            requestMatcher?.also(contentSecurityPolicy::requestMatcher)
+            requireCspPathPatterns?.also(contentSecurityPolicy::requestMatchers)
         }
     }
 }