Spring/spring-boot
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Add properties for content security policy

Browse Source 
Add `content-security-policy` and `content-security-policy-mode`
`security.header` properties and update auto-configuration to apply
them when specified.

Fixes gh-7373
Closes gh-7357
This commit is contained in:
Christoffer Sawicki
2016-11-12 20:36:54 +01:00
committed by Phillip Webb
parent de26b22fa4
commit d7bbea63b7
4 changed files with 82 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

38
spring-boot-autoconfigure/src/main/java/org/springframework/boot/autoconfigure/security/SecurityProperties.java
View File

@@ -174,6 +174,18 @@ public class SecurityProperties implements SecurityPrerequisite {
NONE, DOMAIN, ALL
}
public enum ContentSecurityPolicyMode {
/**
* Use the {@code Content-Security-Policy} header.
*/
DEFAULT,
/**
* Use the {@code Content-Security-Policy-Report-Only} header.
*/
REPORT_ONLY
}
/**
* Enable cross site scripting (XSS) protection.
*/
@@ -194,6 +206,16 @@ public class SecurityProperties implements SecurityPrerequisite {
*/
private boolean contentType = true;
/**
* Value for content security policy header.
*/
private String contentSecurityPolicy;
/**
* Whether to use the "Content-Security-Policy" or "Content-Security-Policy-Report-Only" header.
*/
private ContentSecurityPolicyMode contentSecurityPolicyMode = ContentSecurityPolicyMode.DEFAULT;
/**
* HTTP Strict Transport Security (HSTS) mode (none, domain, all).
*/
@@ -231,6 +253,22 @@ public class SecurityProperties implements SecurityPrerequisite {
this.contentType = contentType;
}
public String getContentSecurityPolicy() {
return this.contentSecurityPolicy;
}
public void setContentSecurityPolicy(String contentSecurityPolicy) {
this.contentSecurityPolicy = contentSecurityPolicy;
}
public ContentSecurityPolicyMode getContentSecurityPolicyMode() {
return this.contentSecurityPolicyMode;
}
public void setContentSecurityPolicyMode(ContentSecurityPolicyMode contentSecurityPolicyMode) {
this.contentSecurityPolicyMode = contentSecurityPolicyMode;
}
public HSTS getHsts() {
return this.hsts;
}

9
spring-boot-autoconfigure/src/main/java/org/springframework/boot/autoconfigure/security/SpringBootWebSecurityConfiguration.java
View File

@@ -108,6 +108,15 @@ public class SpringBootWebSecurityConfiguration {
if (!headers.isContentType()) {
configurer.contentTypeOptions().disable();
}
if (StringUtils.hasText(headers.getContentSecurityPolicy())) {
if (headers.getContentSecurityPolicyMode() == Headers.ContentSecurityPolicyMode.DEFAULT) {
configurer.contentSecurityPolicy(headers.getContentSecurityPolicy());
}
else {
assert headers.getContentSecurityPolicyMode() == Headers.ContentSecurityPolicyMode.REPORT_ONLY;
configurer.contentSecurityPolicy(headers.getContentSecurityPolicy()).reportOnly();
}
}
if (!headers.isXss()) {
configurer.xssProtection().disable();
}