Protect halOP using CSP and the Trusted Types API

[hpehl]

Use content security policies (CSP) on the server side and the trusted types API on the client side to protect halOP against any kind of cross-site scripting (XSS) attacks.

The server-side part requires adding CSP headers, creating a nonce or hash on the server side. This includes WildFly as well as the standalone Quarkus server.

Resource:

• https://developer.mozilla.org/en-US/docs/Web/Security/Attacks/XSS
• https://developer.mozilla.org/en-US/docs/Web/HTTP/Guides/CSP
• https://developer.mozilla.org/en-US/docs/Web/API/Trusted_Types_API
• https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Headers/Content-Security-Policy
• https://github.com/crysknife-io/crysknife/releases/tag/v0.11 (11. Trusted Types Support)