Spring/spring-security
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Polish XFrameOptionsHeaderWriter

Browse Source 
Issue: gh-4559
This commit is contained in:
Rob Winch
2017-10-06 22:01:12 -05:00
parent 02a78b17b9
commit 93ac706d86
2 changed files with 50 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

6
web/src/main/java/org/springframework/security/web/header/writers/frameoptions/XFrameOptionsHeaderWriter.java
View File

@@ -82,8 +82,10 @@ public final class XFrameOptionsHeaderWriter implements HeaderWriter {
*/
public void writeHeaders(HttpServletRequest request, HttpServletResponse response) {
if (XFrameOptionsMode.ALLOW_FROM.equals(frameOptionsMode)) {
String allowFromValue = allowFromStrategy.getAllowFromValue(request);
if (allowFromValue != null && !allowFromValue.equals(XFrameOptionsMode.DENY.getMode())) {
String allowFromValue = this.allowFromStrategy.getAllowFromValue(request);
if(XFrameOptionsMode.DENY.getMode().equals(allowFromValue)) {
response.setHeader(XFRAME_OPTIONS_HEADER, XFrameOptionsMode.DENY.getMode());
} else if (allowFromValue != null) {
response.setHeader(XFRAME_OPTIONS_HEADER,
XFrameOptionsMode.ALLOW_FROM.getMode() + " " + allowFromValue);
}