org.springframework.security.config.annotation.web.configurers

Class HeadersConfigurer<H extends HttpSecurityBuilder<H>>

java.lang.Object

org.springframework.security.config.annotation.SecurityConfigurerAdapter<org.springframework.security.web.DefaultSecurityFilterChain,B>

org.springframework.security.config.annotation.web.configurers.AbstractHttpConfigurer<HeadersConfigurer<H>,H>

org.springframework.security.config.annotation.web.configurers.HeadersConfigurer<H>

All Implemented Interfaces:

SecurityConfigurer<org.springframework.security.web.DefaultSecurityFilterChain,H>

public class HeadersConfigurer<H extends HttpSecurityBuilder<H>>
extends AbstractHttpConfigurer<HeadersConfigurer<H>,H>

Adds the Security HTTP headers to the response. Security HTTP headers is activated by default when using WebSecurityConfigurerAdapter's default constructor.

The default headers include are:

 Cache-Control: no-cache, no-store, max-age=0, must-revalidate
 Pragma: no-cache
 Expires: 0
 X-Content-Type-Options: nosniff
 Strict-Transport-Security: max-age=31536000 ; includeSubDomains
 X-Frame-Options: DENY
 X-XSS-Protection: 1; mode=block
 

Since:

3.2

Author:

Rob Winch, Tim Ysewyn, Joe Grandja, Eddú Meléndez

Nested Class Summary

Nested Classes

Modifier and Type	Class and Description
class	HeadersConfigurer.CacheControlConfig
class	HeadersConfigurer.ContentSecurityPolicyConfig
class	HeadersConfigurer.ContentTypeOptionsConfig
class	HeadersConfigurer.FrameOptionsConfig
class	HeadersConfigurer.HpkpConfig
class	HeadersConfigurer.HstsConfig
class	HeadersConfigurer.ReferrerPolicyConfig
class	HeadersConfigurer.XXssConfig

Constructor Summary

Constructors

Constructor and Description
HeadersConfigurer() Creates a new instance

Method Summary

Modifier and Type	Method and Description
HeadersConfigurer<H>	addHeaderWriter(org.springframework.security.web.header.HeaderWriter headerWriter) Adds a HeaderWriter instance
HeadersConfigurer.CacheControlConfig	cacheControl() Allows customizing the CacheControlHeadersWriter.
void	configure(H http) Configure the SecurityBuilder by setting the necessary properties on the SecurityBuilder.
HeadersConfigurer.ContentSecurityPolicyConfig	contentSecurityPolicy(java.lang.String policyDirectives) Allows configuration for Content Security Policy (CSP) Level 2.
HeadersConfigurer.ContentTypeOptionsConfig	contentTypeOptions() Configures the XContentTypeOptionsHeaderWriter which inserts the X-Content-Type-Options:
HeadersConfigurer<H>	defaultsDisabled() Clears all of the default headers from the response.
HeadersConfigurer.FrameOptionsConfig	frameOptions() Allows customizing the XFrameOptionsHeaderWriter.
HeadersConfigurer.HpkpConfig	httpPublicKeyPinning() Allows customizing the HpkpHeaderWriter which provides support for HTTP Public Key Pinning (HPKP).
HeadersConfigurer.HstsConfig	httpStrictTransportSecurity() Allows customizing the HstsHeaderWriter which provides support for HTTP Strict Transport Security (HSTS).
HeadersConfigurer.ReferrerPolicyConfig	referrerPolicy() Allows configuration for Referrer Policy.
HeadersConfigurer.ReferrerPolicyConfig	referrerPolicy(org.springframework.security.web.header.writers.ReferrerPolicyHeaderWriter.ReferrerPolicy policy) Allows configuration for Referrer Policy.
HeadersConfigurer.XXssConfig	xssProtection() Note this is not comprehensive XSS protection!

Methods inherited from class org.springframework.security.config.annotation.web.configurers.AbstractHttpConfigurer

disable, withObjectPostProcessor

Methods inherited from class org.springframework.security.config.annotation.SecurityConfigurerAdapter

addObjectPostProcessor, and, getBuilder, init, postProcess, setBuilder

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Constructor Detail

HeadersConfigurer

public HeadersConfigurer()

Creates a new instance

See Also:

HttpSecurity.headers()

Method Detail

addHeaderWriter

public HeadersConfigurer<H> addHeaderWriter(org.springframework.security.web.header.HeaderWriter headerWriter)

Adds a HeaderWriter instance

Parameters:

headerWriter - the HeaderWriter instance to add

Returns:

the HeadersConfigurer for additional customizations

contentTypeOptions

public HeadersConfigurer.ContentTypeOptionsConfig contentTypeOptions()

Configures the XContentTypeOptionsHeaderWriter which inserts the X-Content-Type-Options:

 X-Content-Type-Options: nosniff
 

Returns:

the ContentTypeOptionsConfig for additional customizations

xssProtection

public HeadersConfigurer.XXssConfig xssProtection()

Note this is not comprehensive XSS protection!

Allows customizing the XXssProtectionHeaderWriter which adds the X-XSS-Protection header

Returns:

the HeadersConfigurer for additional customizations

cacheControl

public HeadersConfigurer.CacheControlConfig cacheControl()

Allows customizing the CacheControlHeadersWriter. Specifically it adds the following headers:

• Cache-Control: no-cache, no-store, max-age=0, must-revalidate
• Pragma: no-cache
• Expires: 0

Returns:

the HeadersConfigurer for additional customizations

httpStrictTransportSecurity

public HeadersConfigurer.HstsConfig httpStrictTransportSecurity()

Allows customizing the HstsHeaderWriter which provides support for HTTP Strict Transport Security (HSTS).

Returns:

the HeadersConfigurer for additional customizations

frameOptions

public HeadersConfigurer.FrameOptionsConfig frameOptions()

Allows customizing the XFrameOptionsHeaderWriter.

Returns:

the HeadersConfigurer for additional customizations

httpPublicKeyPinning

public HeadersConfigurer.HpkpConfig httpPublicKeyPinning()

Allows customizing the HpkpHeaderWriter which provides support for HTTP Public Key Pinning (HPKP).

Returns:

the HeadersConfigurer for additional customizations

Since:

4.1

contentSecurityPolicy

public HeadersConfigurer.ContentSecurityPolicyConfig contentSecurityPolicy(java.lang.String policyDirectives)

Allows configuration for Content Security Policy (CSP) Level 2.

Calling this method automatically enables (includes) the Content-Security-Policy header in the response using the supplied security policy directive(s).

Configuration is provided to the ContentSecurityPolicyHeaderWriter which supports the writing of the two headers as detailed in the W3C Candidate Recommendation:

• Content-Security-Policy
• Content-Security-Policy-Report-Only

Returns:

the ContentSecurityPolicyConfig for additional configuration

Throws:

java.lang.IllegalArgumentException - if policyDirectives is null or empty

Since:

4.1

See Also:

ContentSecurityPolicyHeaderWriter

defaultsDisabled

public HeadersConfigurer<H> defaultsDisabled()

Clears all of the default headers from the response. After doing so, one can add headers back. For example, if you only want to use Spring Security's cache control you can use the following:

 http.headers().defaultsDisabled().cacheControl();
 

Returns:

the HeadersConfigurer for additional customization

configure

public void configure(H http)
               throws java.lang.Exception

Description copied from interface: SecurityConfigurer

Configure the SecurityBuilder by setting the necessary properties on the SecurityBuilder.

Specified by:

configure in interface SecurityConfigurer<org.springframework.security.web.DefaultSecurityFilterChain,H extends HttpSecurityBuilder<H>>

Overrides:

configure in class SecurityConfigurerAdapter<org.springframework.security.web.DefaultSecurityFilterChain,H extends HttpSecurityBuilder<H>>

Throws:

java.lang.Exception

referrerPolicy

public HeadersConfigurer.ReferrerPolicyConfig referrerPolicy()

Allows configuration for Referrer Policy.

Configuration is provided to the ReferrerPolicyHeaderWriter which support the writing of the header as detailed in the W3C Technical Report:

• Referrer-Policy

Default value is:

 Referrer-Policy: no-referrer
 

Returns:

the ReferrerPolicyConfig for additional configuration

Since:

4.2

See Also:

ReferrerPolicyHeaderWriter

referrerPolicy

public HeadersConfigurer.ReferrerPolicyConfig referrerPolicy(org.springframework.security.web.header.writers.ReferrerPolicyHeaderWriter.ReferrerPolicy policy)

Allows configuration for Referrer Policy.

Configuration is provided to the ReferrerPolicyHeaderWriter which support the writing of the header as detailed in the W3C Technical Report:

• Referrer-Policy

Returns:

the ReferrerPolicyConfig for additional configuration

Throws:

java.lang.IllegalArgumentException - if policy is null or empty

Since:

4.2

See Also:

ReferrerPolicyHeaderWriter