org.apache.struts2.interceptor.csp

## Interface CspSettings

- All Known Implementing Classes:
    DefaultCspSettings

      public interface CspSettings

  CspSettings interface used by the `CspInterceptor` to add the CSP header to the response. The default implementation can be found in `DefaultCspSettings`.
  See Also:
    `DefaultCspSettings`

- - ### Field Summary

    Fields
    Modifier and Type | Field and Description
    --- | ---
    `static String` | `BASE_URI`
    `static String` | `CSP_ENFORCE_HEADER`
    `static String` | `CSP_REPORT_HEADER`
    `static String` | `CSP_REPORT_TYPE`
    `static String` | `HTTP`
    `static String` | `HTTPS`
    `static int` | `NONCE_RANDOM_LENGTH`
    `static String` | `NONE`
    `static String` | `OBJECT_SRC`
    `static String` | `REPORT_TO`
    `static String` | `REPORT_URI`
    `static String` | `SCRIPT_SRC`
    `static String` | `STRICT_DYNAMIC`

  - ### Method Summary

    All Methods Instance Methods Abstract Methods
    Modifier and Type | Method and Description
    --- | ---
    `void` | `addCspHeaders(javax.servlet.http.HttpServletRequest request, javax.servlet.http.HttpServletResponse response)` Adds CSP related headers to response based on request state (e.g., if session has been created)
    `void` | `setEnforcingMode(boolean value)` Sets CSP headers in enforcing mode when true, and report-only when false
    `void` | `setReportTo(String group)` Sets the report group where csp violation reports will be sent
    `void` | `setReportUri(String uri)` Sets the uri where csp violation reports will be sent

- - ### Field Detail

    - #### NONCE_RANDOM_LENGTH

          static final int NONCE_RANDOM_LENGTH

      See Also:
        Constant Field Values

    - #### CSP_ENFORCE_HEADER

          static final String CSP_ENFORCE_HEADER

      See Also:
        Constant Field Values

    - #### CSP_REPORT_HEADER

          static final String CSP_REPORT_HEADER

      See Also:
        Constant Field Values

    - #### OBJECT_SRC

          static final String OBJECT_SRC

      See Also:
        Constant Field Values

    - #### SCRIPT_SRC

          static final String SCRIPT_SRC

      See Also:
        Constant Field Values

    - #### BASE_URI

          static final String BASE_URI

      See Also:
        Constant Field Values

    - #### REPORT_URI

          static final String REPORT_URI

      See Also:
        Constant Field Values

    - #### REPORT_TO

          static final String REPORT_TO

      See Also:
        Constant Field Values

    - #### NONE

          static final String NONE

      See Also:
        Constant Field Values

    - #### STRICT_DYNAMIC

          static final String STRICT_DYNAMIC

      See Also:
        Constant Field Values

    - #### HTTP

          static final String HTTP

      See Also:
        Constant Field Values

    - #### HTTPS

          static final String HTTPS

      See Also:
        Constant Field Values

    - #### CSP_REPORT_TYPE

          static final String CSP_REPORT_TYPE

      See Also:
        Constant Field Values

  - ### Method Detail

    - #### addCspHeaders

          void addCspHeaders(javax.servlet.http.HttpServletRequest request,
                             javax.servlet.http.HttpServletResponse response)

      Adds CSP related headers to response based on request state (e.g., if session has been created)
      Since:
        Struts 6.0.3

    - #### setReportUri

          void setReportUri(String uri)

      Sets the uri where csp violation reports will be sent

    - #### setReportTo

          void setReportTo(String group)

      Sets the report group where csp violation reports will be sent
      Since:
        Struts 6.5.0

    - #### setEnforcingMode

          void setEnforcingMode(boolean value)

      Sets CSP headers in enforcing mode when true, and report-only when false

Copyright © 2000–2026 Apache Software Foundation. All rights reserved.