package com.airlock.iam.common.domain.service.csp;

public final class CspDocumentationText {
   public static final String CSP_NONCE_PLACEHOLDER = "${cspNonce}";
   public static final String CSP_DOCUMENTATION_TEXT = "<p>The placeholder '${cspNonce}' in the policy will be replaced with a fresh, randomly generated nonce for each request. The same nonce must be present in all policy relevant tags that were generated by a specific request.</p><p><b>Known use cases requiring CSP customization</b></p><ul><li>IAM is embedded in an (i)frame: frame-ancestors directive must be relaxed.</li></ul><p><b>Security Warning:</b> The default CSP was designed to offer a good level of security and maintainability. The CSP is validated to work with IAM (see limitations above). Defining a custom CSP may reduce the level of security and may lead to browsers blocking IAM pages. Therefore, the security benefits of a custom policy must be evaluated carefully and IAM must be tested to work with the policy.</p>";

   private CspDocumentationText() {
   }
}