anchor.diff:  If the site violates this policy, by attempting to load a script from _evil.com_, the user-agent will send a violation report to the declared URL specified by the _report-uri_ directive, but still allow the violating resource to load nevertheless.
   
   [[webflux-headers-csp-configure]]
  -===== Configuring Content Security Policy
  +=== Configuring Content Security Policy
   
   It's important to note that Spring Security *_does not add_* Content Security Policy by default.
   The web application author must declare the security policy(s) to enforce and/or monitor for the protected resources.
  
positive.code: ----
  
  [[webflux-headers-content-type-options]]
  ==== Content Type Options
  Historically browsers, including Internet Explorer, would try to guess the content type of a request using http://en.wikipedia.org/wiki/Content_sniffing[content sniffing].
  This allowed browsers to improve the user experience by guessing the content type on resources that had not specified the content type.
  For example, if a browser encountered a JavaScript file that did not have the content type specified, it would be able to guess the content type and then execute it.
  
  [NOTE]
  ====
  There are many additional things one should do (i.e. only display the document in a distinct domain, ensure Content-Type header is set, sanitize the document, etc) when allowing content to be uploaded.
  However, these measures are out of the scope of what Spring Security provides.
  It is also important to point out when disabling content sniffing, you must specify the content type in order for things to work properly.
  ====
  
  The problem with content sniffing is that this allowed malicious users to use polyglots (i.e. a file that is valid as multiple content types) to execute XSS attacks.
  For example, some sites may allow users to submit a valid postscript document to a website and view it.
  
negative.code: ----
  
  [[webflux-headers-csp-links]]
  === Additional Resources
  
  Applying Content Security Policy to a web application is often a non-trivial undertaking.
  The following resources may provide further assistance in developing effective security policies for your site.
  