title: content-security-policy header for a jsf, primefaces application
body: <p>As JSF and Primefaces components result in inline scripts, it is difficult to configure the CSP header in its best configuration.  </p>
  
  <p>As <a href="https://stackoverflow.com/questions/7722159/csrf-xss-and-sql-injection-attack-prevention-in-jsf">JSF by design provides XSS protection</a>, is it okay to not use CSP at all or what shall be the best CSP value for a JSF+Primefaces application?  </p>
  
  <p>Also, there is not much discussion/sample-code available on the topic on Internet <a href="https://stackoverflow.com/questions/22593549/java-server-faces-and-content-security-policy">[1]</a><a href="https://forum.primefaces.org/viewtopic.php?t=43356" rel="nofollow noreferrer">[2]</a>. Aren't JSF and Primefaces planning to provide easier implementation of CSP, as it is 'defense-in-depth', highly recommended header?</p>