通过 Spring Security 的 Content-Security-Policy 不起作用

如何解决通过 Spring Security 的 Content-Security-Policy 不起作用

今天我尝试用 spring security 和 spring boot 来实现 Content-Security-Policy。以下是作为 spring 安全性一部分的配置。

        http
        .cors().and()
        .csrf().disable()
        .headers()
        .addHeaderWriter(new StaticHeadersWriter("Content-Security-Policy","script-src none; style-src none;"))
        .and()
        .sessionManagement()
        .sessionAuthenticationStrategy(sessionAuthenticationStrategy())
        .and()
        .addFilterBefore(keycloakPreAuthActionsFilter(),logoutFilter.class)
        .addFilterBefore(keycloakAuthenticationProcessingFilter(),logoutFilter.class)
        .addFilterafter(keycloakSecurityContextRequestFilter(),SecurityContextHolderAwareRequestFilter.class)
        .addFilterafter(keycloakAuthenticatedActionsRequestFilter(),KeycloakSecurityContextRequestFilter.class)
        .exceptionHandling().authenticationEntryPoint(authenticationEntryPoint())
        .and()
        .logout()
        .addlogoutHandler(keycloaklogoutHandler())
        .logoutUrl("/sso/logout").permitAll()
        .logoutSuccessUrl("/").and()
        .antMatcher("/**")
        .authorizeRequests()
        .antMatchers("/swagger-ui.html").permitAll()
        .antMatchers("/swagger-ui/**").permitAll()
        .antMatchers("/v3/api-docs/**").permitAll()
        .antMatchers("/token").permitAll()
        .antMatchers("/app/**").permitAll()
        .antMatchers("/ignore/**").permitAll()
        .anyRequest().authenticated();
    }

根据代码 Content-Security-Policy 属性被添加到响应中，如下所示

HTTP/1.1 200
vary: Origin
vary: Access-Control-Request-Method
vary: Access-Control-Request-Headers
Access-Control-Allow-Origin: http://localhost:4200
Access-Control-Allow-Credentials: true
Set-Cookie: JSESSIONID=DE7BF66B7B8EE56A863XXXXXXXXXXX; Path=/; HttpOnly
X-Content-Type-Options: nosniff
X-XSS-Protection: 1; mode=block
Cache-Control: no-cache,no-store,max-age=0,must-revalidate
Pragma: no-cache
Expires: 0
x-frame-options: DENY
Content-Security-Policy: script-src none;style-src none;
Content-Type: application/json
transfer-encoding: chunked
Date: Thu,03 Jun 2021 20:46:05 GMT
Keep-Alive: timeout=60
Connection: keep-alive

虽然策略已正确添加到响应中，但我已给出 script-src none; style-src none; 但整个应用程序加载仍然没有任何问题，也没有出现任何错误。

我什至尝试过：

.headers().contentSecurityPolicy("script-src 'none';")
.headers().contentSecurityPolicy("script-src 'self';")

尽管浏览器中有多个试验响应体的事件显示了 Content-Security-Policy 属性，但它没有按预期工作。

如果我遗漏了什么，请提出建议。

提前致谢。