Security HTTP response headers

The following sections discuss Spring Security's support for adding various security headers to the response.

Default security headers

Spring Security allows users to easily inject default security headers to assist in protecting their application. The following is a list of the current default security headers provided by Spring Security:

• Cache-Control
• Content-Type Options
• HTTP Strict Transport Security
• X-Frame-Options
• X-XSS-Protection

While each of these headers is considered best practice, it should be noted that not all clients utilize these headers, so additional testing is encouraged. For passivity reasons, if you are using Spring Security's XML namespace support, you must explicitly...