[WICKET-7107] CSP Header not rendered when using RedirectPolicy.AUTO_REDIRECT

• Type: Bug
• Status: Open
• Priority: Major
• Resolution: Unresolved
• Affects Version/s: 9.16.0
• Component/s: wicket-core
• Assignee: Unassigned
• Reporter: Dirk Forchel
• Created: 23/Apr/24 10:13
• Updated: 23/May/24 09:48

Description

If we redirect to another Web Page and use the RedirectPolicy.AUTO_REDIRECT, this results in the CSP directives being missing in the head of the result page.

I've attached a quickstart application to show the error. Just browse to http://localhost:8080/redirect and use the browser's developer console of your choice. The CSP is not included if Wicket performs a RestartResponseException with a WebPage instance like this

throw new RestartResponseException(new HomePage(new PageParameters()));

If you open the home page directly http://localhost:8080/ the response does include a CSP.

There is an additional test for the CSPRequestCycleListener with different page classes as test parameters.

Relates to https://issues.apache.org/jira/browse/WICKET-7028

Issue Links

• relates to: WICKET-7028 CSP header not rendered when using RedirectPolicy.NEVER_REDIRECT
• links to: GitHub Pull Request #846