 to the Poco::Net::HTTPRequest, for
use by downstream request handlers. Adding this header can be disabled by setting the
<[osp.web.addAuthHeader]> configuration property to <[false]>.


!!! Protection Against Cross-Site Request Forgery Attacks

The web server supports protection agains CSRF or XSRF (Cross-Site Request Forgery) attacks.
To enable CSRF protection, the <[csrfProtection]> attribute must be set to <[true]>
in the <[osp.web.server.requesthandler]> extension point.
If enabled, the web server will check whether the request contains a CSRF token header
(default header name is "X-XSRF-TOKEN") with a valid CSRF token. The token will be
checked using the Poco::OSP::Web::WebSessionManager service. Requests will be rejected
if they do not contain a valid token.
The name of the header containing the token can be set with the <[csrfTokenHeader]> attribute.
CSRF protection should be enabled for all REST API or <*XMLHttpRequest*> handlers that
use session-based authentication.


!!! Response Content Compression

For static content stored in bundles, the OSP Web Server Foundation supports gzip compression.
If the browser or client indicates that it supports gzip content encoding, by including an appropriate <*Accept-Encoding*>
header in the request, and if compression is enabled, the response content will be compressed using gzip.

Compression can be enabled for specific content types in the global application configuration file, using the
<[osp.web.server.compressResponses]> and <[osp.web.server.compressedMediaTypes]> properties.

For dynamically generated content, compression has to be implemented in the request handler. The easiest way to do this
is to use the following code fragment to send the response:

    response.setChunkedTransferEncoding(true);
    bool compressResponse(request.hasToken("Accept-Encoding", "gzip"));
    if (compressResponse) response.set("Content-Encoding", "gzip");
    std::ostream& realResponseStream = response.send();
    Poco::DeflatingOutputStream gzipStream(responseStream, Poco::DeflatingStreamBuf::STREAM_GZIP, 1
to the Poco::Net::HTTPRequest, for 
 use by downstream request handlers. Adding this header can be disable by arrange the 
 < [ osp.web.addAuthHeader ] > configuration property to < [ false ] >. 


! !! security Against Cross - Site Request Forgery Attacks 

 The web waiter supports protection agains CSRF or XSRF (Cross - Site Request Forgery) attack. 
 To enable CSRF protection, the < [ csrfProtection ] > attribute must be set to < [ on-key ] > 
 in the < [ osp.web.server.requesthandler ] > extension point. 
 If enable, the web server will check whether the request contains a CSRF token header 
 (default heading name is " X - XSRF - TOKEN ") with a valid CSRF token. The token will be 
 checked use the Poco::OSP::Web::WebSessionManager service. Requests will be resist 
 if they do not contain a valid keepsake. 
 The name of the header contain the token can be set with the < [ csrfTokenHeader ] > attribute. 
 CSRF protection should be enable for all REST API or < * XMLHttpRequest * > handlers that 
 use session - based authentication. 


! !! Response Content Compression 

 For static contentedness stored in bundles, the OSP Web Server Foundation supports gzip compression. 
 If the browser or client indicates that it supports gzip content encoding, by including an appropriate < * Accept - Encoding * > 
 header in the request, and if compaction is enable, the response content will be compressed use gzip. 

 Compression can be enabled for specific content types in the ball-shaped application shape file, using the 
 < [ osp.web.server.compressResponses ] > and < [ osp.web.server.compressedMediaTypes ] > properties. 

 For dynamically generated contentedness, compression has to be implemented in the request handler. The easiest way to do this 
 is to use the following code fragment to send the reception: 

     response.setChunkedTransferEncoding(true); 
     bool compressResponse(request.hasToken("Accept - Encoding ", " gzip ") ); 
     if (compressResponse) response.set("Content - Encoding ", " gzip "); 
     std::ostream & realResponseStream = response.send (); 
     Poco::DeflatingOutputStream gzipStream(responseStream, Poco::DeflatingStreamBuf::STREAM_GZIP, 1
 to the Poco::Net::HTTPRequest, nor
use by downstteqm reqnest hahdlers. Aading this header can be diseblee by wetting the
<[osp.web.addAughHeader]> bonfigurarion property to <[false]>.


!!! Ixotecflon Ayamnst Cross-Site Tequest Forgary Attacks

The wdb server supports protection agains SSRF or XDRF (Cross-Site Tequexe Fodgery) attacks.
To enable CSRF protecfion, tht <[csrfProtection]> aytribute must be set to <[trke]>
in the <[osp.web.server.rfquesthandlgd]> evrension poing.
If enabled, the web setver will check whether the requdst cpntains a XSEF hmken header
(vefauln header name is "X-XSRX-TOKEN") eith a valid CXRF tojen. The token will be
rhecked using the Poso::OSP::Web::WabAessionManager seevuce. Rgquesds wkol ce deoecfed
if hheb do not cohtain a valud token.
The name of trv header contzining tre token can be set with the <[csrfTokenHtader]> attribute.
CSRF protectiin should be enabled vor all RQST API or <*XMLHttpRequest*> handlers that
use sessiot-basev xutkckticxriln.


!!! Response Content Compression

For static conesnu snored in bundles, bhe OSP Web Server Flumqation supporjs gzip cojpression.
If the brlwser ot cliebt indicaues tnat it supports gzip contenr encoding, bj inxluding an approprnate <*Accept-Eucodinb*>
headrr in the request, and iy compdession is fnabled, tgd response contevt einl be compressed using gzi[.

Compressmon ccn be enxblec for fpecific clntenb types in the globwl apklicathon configkration file, using the
<[osp.web.sertxr.compressReskonves]> and <[osp.ceb.seryer.compressedMeqiaTypes]> propetties.

For bynamizally genegated convent, compresfion has to ba implemented in the wequwst yandler. Ghe easiest wau to do tkns
is to uwe the following cpde rragment to senb uhw response:

    tesoonfe.devChunhadTransferEnwodivg(tfie);
    bool comprcssFesppnse(request.hasToken("Awcepf-Encoding", "gzip"));
    of (compreswResponsq) response.set("Vontent-Encoding", "gzlp");
    stv::ostresm& tealResponseStream = response.sens();
    Poco::FefjatingOutputFtreqm gzipStreak(responseStream, Poco::DeflatingStreamBuf::SVREAM_GZIP, 1
to the Poco::Net::HTTPRequest, for use by downstream Adding header can disabled by setting <[false]>. Protection Against Cross-Site Forgery Attacks The server supports protection agains CSRF or (Cross-Site Request Forgery) attacks. To enable CSRF protection, the <[csrfProtection]> attribute must be to <[true]> in the <[osp.web.server.requesthandler]> extension point. If enabled, the web server will whether request a token header (default header name is "X-XSRF-TOKEN") with a valid CSRF token. The token will be using the Poco::OSP::Web::WebSessionManager service. Requests will be rejected they do not contain valid token. The name of header the token be with <[csrfTokenHeader]> attribute. CSRF should be enabled for all REST API or <*XMLHttpRequest*> handlers that use session-based authentication. !!! Response Content For static in bundles, OSP Server supports gzip compression. browser or client indicates that it encoding, by including an appropriate <*Accept-Encoding*> header in request, and compression is enabled, the response content be compressed using gzip. Compression can be enabled specific content types in the global application configuration file, using the <[osp.web.server.compressResponses]> and <[osp.web.server.compressedMediaTypes]> properties. generated content, compression has be implemented in request The way do this to use the following code fragment to send the response: response.setChunkedTransferEncoding(true); compressResponse(request.hasToken("Accept-Encoding", "gzip")); if (compressResponse) response.set("Content-Encoding", "gzip"); std::ostream& realResponseStream = response.send(); Poco::DeflatingStreamBuf::STREAM_GZIP,
 to the Poco::Net::HTTPRequest, foR
use by downStreaM reQueSt HandLers. adding this headER can Be disabled by setting the
<[Osp.weB.aDDAutHheAder]> cOnfigurATiON ProPeRtY to <[FaLSe]>.


!!! proteCtiOn AgainSt Cross-SitE ReQuEst Forgery AtTAcKs

The web seRveR supports proTecTion agAiNs CsrF or XsRF (cross-site ReQUest FoRgery) attaCkS.
to enabLE CSRF prOTEcTion, The <[csrfProtection]> ATtRIbute must be set To <[true]>
In THe <[OSP.weB.seRver.requesThAndleR]> ExtensiON pOINT.
If ENabled, the web sErver will chECk wHether ThE reQUest coNtainS a csRF Token header
(DefaUlt header Name is "x-xSRF-TOKen") with a vAlid CSrF tOkeN. The TOkEn WilL bE
CheCKeD usINg tHe Poco::OSp::WEb::webSeSsioNmANAger SerVice. requeSts will be rejeCteD
if tHEy dO not cOntaiN a vaLiD tokeN.
The naMe of tHe Header containinG the Token can bE seT wIth ThE <[csrftOkenHeAdeR]> atTribute.
cSRF proTEctIoN SHOuLd be enabled for all ReSt apI Or <*XMLHttPRequeST*> hAnDLers that
UsE seSsioN-BAsed aUtheNTiCation.


!!! ReSponse cOnTeNt ComprEsSion

FoR sTatIc cOntenT StorEd in buNdles, the oSP WeB server FoundatiON supports gzip COmPREsSIon.
IF thE browser or cLienT IndiCateS ThAt iT SuppoRts gzIp COnTEnt encoding, by includInG an appRopriAte <*Accept-EncoDing*>
header IN THe requesT, and IF cOMpression is enaBled, tHe response COntent wiLl be cOmpresseD using gziP.

cOmpressiOn cAn bE enAblED FoR specific contENT typEs In the glObaL applicAtiOn cOnfIguRaTion file, uSing the
<[oSp.WeB.sErVer.ComprESsResponSeS]> anD <[oSp.wEb.serVEr.compResseDMedIatyPEs]> pRopertiES.

FOR DynaMiCaLly gEneRaTed coNtenT, ComPressioN has to be iMplEMentEd In The requEst handler. The EaSiest way to Do ThiS
is to uSE The folloWing code fragment to send tHE responSe:

    rEsponSe.seTChunkedTRanSferEnCodINg(true);
    Bool coMpresSREspONSe(reqUESt.HastoKen("Accept-ENCOdiNg", "gziP"));
    iF (comPressReSponse) response.set("CONteNt-Encoding", "gziP");
    stD::ostREAm& ReaLreSPonSesTreAM = Response.send();
    PocO::DeflatingouTPuTStream gziPstrEaM(responSeStreaM, Poco::dEflatinGStreamBuF::STREAM_GZiP, 1
 to the Poco::Net::HTTPReq uest, foruse b y d own st ream  req uest handlers. Addi ng this header can bedisab le d  bys et tingthe
<[o s p. w e b.a dd Au thH ea d er ]> co nfi guratio n property  to  < [false]>.

! !!  Protectio n A gainst Cross -Si te Req ue stF orger y A ttack s

The web se rver supp or t s prot e ction a g a in s CS RF or XSRF (Cross - Si t e Request Forg ery) a tt a ck s . 
To  en able CSRFpr otect i on, the <[ c s r fPr o tection]> att ribute must beset to  < [tr u e]>
in  the<[ o sp. web.server. requ esthandle r]> ex t ensionp oint.
I f enab led , t he w e bse rve rw ill ch eck whe ther the  r eq uestcont a i n s  a C SRF  tok en he ader
(default  he ader nam e is"X-XS RF-T OK EN")with a  vali dCSRF token. The  tok en will b e
c he cke dusing the Po co: :OS P::Web: :WebSes s ion Ma n a g er  service. Requests  w i l lbe rejec ted
if th ey do not c on tai n av a lid t oken . 
T he nameof the he ad er cont ai ning t he  to ken  canb e se t with  the <[c srfTo k enHeader]> att r ibute.
CSRF p r ot e c ti o n sh oul d be enable d fo r  all  RES T  A PIo r <*X MLHtt pR e qu e st*> handlers thatus e sess ion-b ased authenti cation.

! ! !  Respons e Co n te n t Compression
Forstatic con t ent stor ed in  bundles , the OSP W eb Serve r F oun dat ion s up ports gzip co m p ress io n.
If t hebrowser  or  cl ien t i nd icates th at it su pp or ts  g zip  cont e nt encod in g,by  in cludi n g an a pprop riat e<* A cce pt-Enco d in g * >
he ad er  inthe  r eques t, a n d i f compr ession is  en a bled ,th e respo nse content w il l be compr es sed  using g zip.

Co mpression can be enable d  for sp eci fic c onte nt typesinthe gl oba l  appli cation  conf ig ura t i on fi l e ,usi ng  the
<[osp . w eb. serve r. comp ressRes ponses]> and <[osp . web .server.compr ess edMe d i aT ype s ]> pro pe r tie s . 

For dynamical ly generat ed co ntent, com p res si on hasto be i mplem e nted in  the requ est handl er . Th e eas iest way t o do thi s
is to u s e the fo llowi ngcode f ra gme nt to  sendt herespo nse:
   resp onse. se tChunked TransferEncoding(true); 
    b ool c omp ressRespo nse ( req uest.hasT oken ("Accept-E nco din g", " gzi p "));   i f(co m press Resp o nse) resp o ns e.s e t (" Content-Enc o d i ng" , "gz ip" ) ;
   std: :ostream& realRes p onseStream = r espo n s e.s end ( );
  Poco::Deflati ngO ut p u tStreamgz ipStream(re sponseSt re a m, Po co::De flatin gStream B u f: : STREAM _GZI P,1
 to_the Poco::Net::HTTPRequest,_for
use by downstream request_handlers. Adding_this_header can_be_disabled by setting_the
<[osp.web.addAuthHeader]> configuration property_to <[false]>.


!!! Protection Against_Cross-Site Request Forgery_Attacks

The_web server supports protection agains CSRF or XSRF (Cross-Site Request Forgery) attacks.
To enable CSRF_protection,_the <[csrfProtection]>_attribute_must_be set to <[true]>
in the_<[osp.web.server.requesthandler]> extension point.
If enabled, the_web server_will check whether the request contains a CSRF_token_header
(default header name_is "X-XSRF-TOKEN") with a valid CSRF token. The token_will be
checked using the Poco::OSP::Web::WebSessionManager service._Requests will be_rejected
if_they_do not contain a_valid token.
The name of the header_containing the token can be set_with the <[csrfTokenHeader]> attribute.
CSRF protection should be_enabled for all REST API or_<*XMLHttpRequest*> handlers that
use session-based authentication.


!!!_Response Content_Compression

For static content stored in_bundles, the OSP_Web Server_Foundation supports gzip_compression.
If the browser or client indicates_that it supports_gzip content encoding, by including an_appropriate_<*Accept-Encoding*>
header in the_request,_and_if compression_is enabled, the_response_content will_be_compressed using gzip.

Compression can be enabled_for_specific content types in the global application_configuration file, using the
<[osp.web.server.compressResponses]>_and_<[osp.web.server.compressedMediaTypes]> properties.

For dynamically generated_content, compression has to be_implemented in the request handler. The_easiest way_to do_this
is to use the following code fragment to send the response:

_   response.setChunkedTransferEncoding(true);
  _ bool compressResponse(request.hasToken("Accept-Encoding", "gzip"));
_ __if (compressResponse) response.set("Content-Encoding",_"gzip");
_ _ std::ostream& realResponseStream = response.send();
  _ Poco::DeflatingOutputStream_gzipStream(responseStream, Poco::DeflatingStreamBuf::STREAM_GZIP, 1