java / intermediate
Snippet
Securing HTTP Response Headers Using SecurityFilterChain
Configuring defensive HTTP response headers in Spring Security protects applications from common vulnerabilities such as Cross-Site Scripting (XSS), clickjacking, and protocol downgrade attacks. Modern Spring Security utilizes lambda DSL configurations on the SecurityFilterChain bean to fine-tune Content Security Policy (CSP), HSTS, and Frame-Options directives.
snippet.java
java
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
@Configuration@EnableWebSecuritypublic class SecurityHeaderConfig {@Beanpublic SecurityFilterChain filterChain(HttpSecurity http) throws Exception {return http.headers(headers -> headers.contentSecurityPolicy(csp -> csp.policyDirectives("default-src 'self'; frame-ancestors 'none';")).httpStrictTransportSecurity(hsts -> hsts.includeSubDomains(true).maxAgeInSeconds(31536000)).frameOptions(HeadersConfigurer.FrameOptionsConfig::deny)).build();}}
spring
Breakdown
1
@Configuration
Marks the class as a Spring configuration bean source.
2
.contentSecurityPolicy(csp -> csp.policyDirectives("default-src 'self'; frame-ancestors 'none';"))
Restricts external resource loading and prevents the application from being embedded in foreign iframes.
3
.httpStrictTransportSecurity(hsts -> hsts.includeSubDomains(true).maxAgeInSeconds(31536000))
Enforces HTTPS connections for one year across the domain and all subdomains.
4
.frameOptions(HeadersConfigurer.FrameOptionsConfig::deny)
Instructs browsers to deny rendering inside any framing context to prevent clickjacking.