Additional Spring Security Features

In this chapter, we will explore several additional Spring Security features that we have not covered so far in this book, including the following topics:

• Cross-Site Scripting (XSS)
• Cross-Site Request Forgery (CSRF)
• Synchronizer token pattern
• Clickjacking
• Testing Spring Security Applications
• Reactive Applications support

We will understand how to include various HTTP headers to protect against common security vulnerabilities, using the following methods:

• Cache-Control
• Content-Type Options
• HTTP Strict Transport Security (HSTS)
• X-Frame-Options
• X-XSS-Protection

Before you read this chapter, you should already understand how Spring Security works. This means you should already be able to set up authentication and authorization in a simple web application. If you are unable to do this, you will want to ensure you have read up to Chapter 3, Custom Authentication, before proceeding with this...