Protect applications against CSRF and configure security policies
masterWicket provides several mechanisms to secure your application against common web vulnerabilities:
- CSRF Protection: Use URL encryption and the
ResourceIsolationRequestCycleListenerto prevent Cross-Site Request Forgery attacks. (Note:CsrfPreventionRequestCycleListeneris deprecated). - Content Security Policy (CSP): Wicket includes support for CSP; you can tune these policies to control which resources your application is allowed to load.
- Cross-Origin Isolation: You can configure Cross-Origin Opener Policy (COOP) and Cross-Origin Embedder Policy (COEP) to achieve cross-origin isolation.
- Package Resource Protection: Use a guard entity to control which package resources are accessible to users.