Package org.apereo.cas.configuration.model.core.web.security

Class HttpHeadersRequestProperties

java.lang.Object
org.apereo.cas.configuration.model.core.web.security.HttpHeadersRequestProperties
All Implemented Interfaces:
Serializable
@RequiresModule(name="cas-server-core-web", automated=true) public class HttpHeadersRequestProperties extends Object implements Serializable
This is HttpHeadersRequestProperties.
Since:
5.3.0
See Also:

  • Constructor Details

    • HttpHeadersRequestProperties

      public HttpHeadersRequestProperties()

  • Method Details

    • isEnabled

      public boolean isEnabled()
      Allow CAS to inject and enforce http security headers via an http filter that are outlined here for caching, HSTS, etc.

    • isCache

      public boolean isCache()
      When true, will inject the following headers into the response for non-static resources. <pre> Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: 0 </pre>

    • isHsts

      public boolean isHsts()
      When true, will inject the following headers into the response: Strict-Transport-Security: ....

    • isXframe

      public boolean isXframe()
      When true, will inject the following headers into the response: X-Frame-Options: DENY.

    • isXcontent

      public boolean isXcontent()
      When true, will inject the following headers into the response: X-Content-Type-Options: nosniff.

    • isXss

      public boolean isXss()
      When true, will inject the following headers into the response: X-XSS-Protection: 1; mode=block.

    • getXframeOptions

      public String getXframeOptions()
      Will inject values into the X-Frame-Options header into the response.

    • getXssOptions

      public String getXssOptions()
      Will inject values into the X-XSS-Protection header into the response.

    • getHstsOptions

      public String getHstsOptions()
      Control the value of the Strict-Transport-Security header.

    • getContentSecurityPolicy

      public String getContentSecurityPolicy()
      Helps you reduce XSS risks on modern browsers by declaring what dynamic resources are allowed to load via a HTTP Header. Header value is made up of one or more directives. Multiple directives are separated with a semicolon.

    • getCacheControlStaticResources

      public String getCacheControlStaticResources()
      Files with these extensions are considered static, so they will be cached by browsers. The value is part of a RegEx.

    • setEnabled

      public HttpHeadersRequestProperties setEnabled(boolean enabled)
      Allow CAS to inject and enforce http security headers via an http filter that are outlined here for caching, HSTS, etc.
      Returns:
      this.

    • setCache

      public HttpHeadersRequestProperties setCache(boolean cache)
      When true, will inject the following headers into the response for non-static resources. <pre> Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: 0 </pre>
      Returns:
      this.

    • setHsts

      public HttpHeadersRequestProperties setHsts(boolean hsts)
      When true, will inject the following headers into the response: Strict-Transport-Security: ....
      Returns:
      this.

    • setXframe

      public HttpHeadersRequestProperties setXframe(boolean xframe)
      When true, will inject the following headers into the response: X-Frame-Options: DENY.
      Returns:
      this.

    • setXcontent

      public HttpHeadersRequestProperties setXcontent(boolean xcontent)
      When true, will inject the following headers into the response: X-Content-Type-Options: nosniff.
      Returns:
      this.

    • setXss

      public HttpHeadersRequestProperties setXss(boolean xss)
      When true, will inject the following headers into the response: X-XSS-Protection: 1; mode=block.
      Returns:
      this.

    • setXframeOptions

      public HttpHeadersRequestProperties setXframeOptions(String xframeOptions)
      Will inject values into the X-Frame-Options header into the response.
      Returns:
      this.

    • setXssOptions

      public HttpHeadersRequestProperties setXssOptions(String xssOptions)
      Will inject values into the X-XSS-Protection header into the response.
      Returns:
      this.

    • setHstsOptions

      public HttpHeadersRequestProperties setHstsOptions(String hstsOptions)
      Control the value of the Strict-Transport-Security header.
      Returns:
      this.

    • setContentSecurityPolicy

      public HttpHeadersRequestProperties setContentSecurityPolicy(String contentSecurityPolicy)
      Helps you reduce XSS risks on modern browsers by declaring what dynamic resources are allowed to load via a HTTP Header. Header value is made up of one or more directives. Multiple directives are separated with a semicolon.
      Returns:
      this.

    • setCacheControlStaticResources

      public HttpHeadersRequestProperties setCacheControlStaticResources(String cacheControlStaticResources)
      Files with these extensions are considered static, so they will be cached by browsers. The value is part of a RegEx.
      Returns:
      this.