| <?xml version="1.0" encoding="UTF-8"?> |
| |
| <!-- |
| * Licensed to the Apache Software Foundation (ASF) under one or more |
| * contributor license agreements. See the NOTICE file distributed with |
| * this work for additional information regarding copyright ownership. |
| * The ASF licenses this file to You under the Apache License, Version 2.0 |
| * (the "License"); you may not use this file except in compliance with |
| * the License. You may obtain a copy of the License at |
| * |
| * http://www.apache.org/licenses/LICENSE-2.0 |
| * |
| * Unless required by applicable law or agreed to in writing, software |
| * distributed under the License is distributed on an "AS IS" BASIS, |
| * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. |
| * See the License for the specific language governing permissions and |
| * limitations under the License. |
| --> |
| |
| <tobago-config |
| xmlns="http://myfaces.apache.org/tobago/tobago-config" |
| xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" |
| xsi:schemaLocation="http://myfaces.apache.org/tobago/tobago-config http://myfaces.apache.org/tobago/tobago-config-5.0.xsd" |
| version="5.0"> |
| |
| <name>tobago-config</name> |
| |
| <content-security-policy mode="on"> |
| <directive name="style-src">'unsafe-inline'</directive> <!-- is only active, when browser doesn't support nonce --> |
| <directive name="style-src">'nonce-${nonce}'</directive> |
| <directive name="style-src">'self'</directive> |
| <directive name="script-src">'self'</directive> |
| <directive name="frame-ancestors">'none'</directive> |
| </content-security-policy> |
| |
| </tobago-config> |
