Release Notes

With the current FirstSpirit version, the Zstandard compression mode is the default value for FirstSpirit protocol compression.

This applies to new API connections, client connection settings, and servlets (web.xml).

If the connection parameters have already been defined differently, the settings are not affected.

The migration to Jakarta EE 6.0 is an essential step to ensure the security of web applications.

Support and current timeline

Here is the current plan:

• 2023-06 Beta-version of the FirstSpirit JakartaEE Edition is available for testing (available via Support)
• 2023-08 Stable release (2023.9) with support for automatic migration
• 2024-08 Support for automatic migration is removed with FirstSpirit 2024.9

The FirstSpirit installation may be affected if any of the following conditions apply:

• The FirstSpirit installation is not maintained in the Crownpeak Cloud and deploys web-applications to an application server like Apache Tomcat.
• A custom module is used that contains a WebApp component with code that uses the legacy JavaEE API, such as the Servlet API.
• A custom module is used that contains a WebApp component with dependencies that use the old JavaEE API, e.g., Spring Boot 2.x.

The module used could be affected if at least one of the following conditions applies:

• The module contains a WebApp component with code that uses the old JavaEE API, e.g., the Servlet API.
• The module contains a WebApp component with dependencies which use the old JavaEE API, e.g., Spring Boot 2.x.

More information and updates can be found in the Crownpeak Community and the detailed Jakarta FAQ.

Contact Customer Support Team if you have questions or feedback regarding the migration.

FirstSpirit 2023.8 supports the following module versions for FirstSpirit Content Experience Tools.

With the current FirstSpirit version it is possible to get corresponding events via SEO URL changes (class de.espirit.firstspirit.event.UrlEvent) using the EventBusAgent (FirstSpirit Developer API, Package de.espirit.firstspirit.agency).

Example script:

import de.espirit.firstspirit.agency.BrokerAgent;
import de.espirit.firstspirit.event.UrlEvent;
import de.espirit.firstspirit.agency.EventBusAgent;
import java.util.function.Consumer;

eventListener = new Consumer<UrlEvent>() {
	void accept(event) {
		...
	}
};

brokerAgent = context.requireSpecialist(BrokerAgent.TYPE);
specialistsBroker = brokerAgent.getBrokerByProjectName("<Projectname>");
eventBusAgent = specialistsBroker.requireSpecialist(EventBusAgent.TYPE);
eventBusAgent.register(UrlEvent.BUS_IDENTIFIER, eventListener);

// optional
Thread.sleep(<time>);
eventBusAgent.unregister(UrlEvent.BUS_IDENTIFIER, eventListener);

The last two lines are optional and are only needed if the events are not to be listened to permanently.

By setting a Content Security Policy via the CSP header, the allowed sources of content such as scripts, stylesheets, images, fonts, and more can be defined.

The CSP header can be configured via the SecurityFilter using the ContentSecurityPolicyHeader parameter.

The ContentSecurityPolicyHeader parameter can be configured in the following files and is evaluated with the following priority:

• web.xml of the WebApp [highest priority]
• fs-server.conf
• Java System-Property
• OS Environment Property [lowest priority]

Default value of the CSP header:

default-src 'self'; object-src 'none'; style-src 'self'; form-action 'self'; 
script-src 'self' 'nonce-$NONCE' $UPGRADE_INSECURE $FRAME_ANCESTORS

The following placeholders can be used in the configuration:

• $NONCE - the nonce value valid for the current HTTP request
• $FRAME_ANCESTORS - allowed frame embedding according to the frameOptionsHeader property from fs-server.conf.
  The replacement with default settings: ; frame-ancestors 'self'
  If ALLOW_ALL is set, the replacement is an empty string.
• $UPGRADE_INSECURE - upgrade-insecure-requests according to what is set for the SecurityFilter in the TransportSecurity parameter or its default value.
  The default value is KEEP_SECURE.
  The replacement with default settings:
  • for an HTTPS request: ; upgrade-insecure-requests
  • for an HTTP request the substitution is an empty string

web.xml of the WebApp

Default configuration:

<filter>
   <filter-name>SecurityFilter</filter-name>
   <filter-class>de.espirit.firstspirit.io.servlet.SecurityFilter</filter-class>
   <init-param>
      <param-name>ContentSecurityPolicyHeader</param-name>
      <param-value>default-src 'self'; object-src 'none'; style-src 'self'; 
                   form-action 'self'; 
                   script-src 'self' 'nonce-$NONCE' $UPGRADE_INSECURE $FRAME_ANCESTORS
      </param-value>
   </init-param>
</filter>

An empty value disables the CSP header:

<filter>
   <filter-name>SecurityFilter</filter-name>
   <filter-class>de.espirit.firstspirit.io.servlet.SecurityFilter</filter-class>
   <init-param>
      <param-name>ContentSecurityPolicyHeader</param-name>
      <param-value></param-value>
   </init-param>
</filter>

fs-server.conf

Default configuration:

securityFilter.ContentSecurityPolicyHeader=default-src 'self'; object-src 'none'; 
style-src 'self'; form-action 'self'; 
script-src 'self' 'nonce-$NONCE' $UPGRADE_INSECURE $FRAME_ANCESTORS

An empty value disables the CSP header:

securityFilter.ContentSecurityPolicyHeader=

Java System-Property

• fs-wrapper.isolated.conf
• setenv.sh file of Tomcat

The value can be set using the parameter
wrapper.java.additional.##=-DsecurityFilter.ContentSecurityPolicyHeader, where ## is the number of a previously unused entry.

OS Environment Property

The value can be defined using the variable named
SecurityFilter_ContentSecurityPolicyHeader.

As of the current release, the following internally used software has been updated:

• Spring Boot
  Update from version 2.7.0 to version 2.7.13