lukaszlenart opened a new pull request, #332: URL: https://github.com/apache/struts-site/pull/332
Companion to [apache/struts#1927](https://github.com/apache/struts/pull/1927) for [WW-5669](https://issues.apache.org/jira/browse/WW-5669). The CSP interceptor page never documented the nonce-source setting under either name. This adds a **Nonce source** section: - the working name `struts.csp.nonce.source`, values `session` (default) / `request`, and why request scope exists (stateless / clustered deployments); - a note that `struts.csp.nonceSource` — shipped inert in `default.properties` since 6.8.0 — is honoured as a deprecated alias from 6.12.0 / 7.4.0, so a configuration already carrying `struts.csp.nonceSource=request` switches to request-scoped nonces on upgrade. The "6.12.0 and" half of the version wording assumes the backport lands; drop it if it doesn't. 🤖 Generated with [Claude Code](https://claude.com/claude-code) -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
