Tobago supports Content Security Policy (CSP) to prevent cross-site scripting (XSS) and related attacks. It is
specified by W3C. In short: The HTML page doesn't contain any JavaScript or CSS information. All allowed sources
for JavaScript, CSS and other resources have to be declared in special header. If you have own renderers or own
JavaScript in your application, this code also needs to support CSP, to use this feature.
Warning:
CSP requires a different handling of JavaScript and other resources. If you use own JavaScript in the HTML page
or including resources from other sites you may need to adapt your application, (or turn this feature off).
Configuration
To add sites to the CSP headers, add
<directive> tags to
<content-security-policy> in the
tobago-config.xml.
To turn off CSP, add an empty
<content-security-policy mode="off">
tag in the configuration. For development, you may also use mode="report-only", which sets the appropriate
header.