Repository navigation
Fix method chaining in ServerHttpSecurity.HeaderSpec.ContentSecurityPolicySpec #19843
Description
Activity
Similar return type problems also exist in some other inner
...Specclasses ofServerHttpSecurity. They were not updated during the v6 to v7 migration period probably because there was effectively only one configuration method in those classes, which implies that no chaining problem existed. However, if any new configuration method is added to those Spec classes, similar problems that blocks method chaining would be raised.Deprecated
HeaderSpec#featurePolicy(String)andFeaturePolicySpec#and()methods could also be cleaned up in v7.x.
In
ServerHttpSecurity.HeaderSpec.ContentSecurityPolicySpec,reportOnly(boolean)andpolicyDirectives(String)returnHeaderSpecinstead ofContentSecurityPolicySpec. That prevents method chaining inside the lambda, unlike the servletContentSecurityPolicyConfig(and unlike the newernonceAttributeName(...),exchangeMatcher(...)andexchangeMatchers(...)methods from #18499, which returnContentSecurityPolicySpec).Changing a return type is not binary compatible, so this likely needs new methods plus deprecation of the existing ones. @ziqin explored this in #18499 (
reportOnly()anddirectives(String)onContentSecurityPolicySpec) and noted the naming inconsistency with the servlet and Kotlin DSLs; it was deferred so that #18499 could stay focused on nonce support.Happy to review a pull request for this.