Security HTTP response headers
The following sections discuss Spring Security’s support for adding various security headers to the response.
Spring Security allows users to easily inject default security headers to assist in protecting their applications. The following is a list of the current default security headers provided by Spring Security:
- Cache-Control
- Content-Type Options
- HTTP Strict Transport Security
- X-Frame-Options
- X-XSS-Protection
While each of these headers is considered best practice, it should be noted that not all clients utilize these headers, so additional testing is encouraged. For passivity reasons, if you are using Spring Security’s XML namespace support, you must explicitly enable the security headers. All of the default headers can be easily added using the <headers> element with no child elements.
If you are using Spring Security’s Java configuration, all of the default security headers are added...
