Spring/spring-security
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Add support for Feature-Policy security header

Browse Source
This commit is contained in:
Vedran Pavic
2018-08-15 22:05:10 +02:00
committed by Rob Winch
parent 9c478257d4
commit c6ea447cc0
9 changed files with 368 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files

9
config/src/main/resources/org/springframework/security/config/spring-security-5.1.rnc
View File

@@ -743,7 +743,7 @@ csrf-options.attlist &=
headers =
## Element for configuration of the HeaderWritersFilter. Enables easy setting for the X-Frame-Options, X-XSS-Protection and X-Content-Type-Options headers.
element headers { headers-options.attlist, (cache-control? & xss-protection? & hsts? & frame-options? & content-type-options? & hpkp? & content-security-policy? & referrer-policy? & header*)}
element headers { headers-options.attlist, (cache-control? & xss-protection? & hsts? & frame-options? & content-type-options? & hpkp? & content-security-policy? & referrer-policy? & feature-policy? & header*)}
headers-options.attlist &=
## Specifies if the default headers should be disabled. Default false.
attribute defaults-disabled {xsd:boolean}?
@@ -821,6 +821,13 @@ referrer-options.attlist &=
## The policies for the Referrer-Policy header.
attribute policy {"no-referrer","no-referrer-when-downgrade","same-origin","origin","strict-origin","origin-when-cross-origin","strict-origin-when-cross-origin","unsafe-url"}?
feature-policy =
## Adds support for Feature Policy
element feature-policy {feature-options.attlist}
feature-options.attlist &=
## The security policy directive(s) for the Feature-Policy header.
attribute policy-directives {xsd:token}?
cache-control =
## Adds Cache-Control no-cache, no-store, must-revalidate, Pragma no-cache, and Expires 0 for every request
element cache-control {cache-control.attlist}

18
config/src/main/resources/org/springframework/security/config/spring-security-5.1.xsd
View File

@@ -2253,6 +2253,7 @@
<xs:element ref="security:hpkp"/>
<xs:element ref="security:content-security-policy"/>
<xs:element ref="security:referrer-policy"/>
<xs:element ref="security:feature-policy"/>
<xs:element ref="security:header"/>
</xs:choice>
<xs:attributeGroup ref="security:headers-options.attlist"/>
@@ -2464,6 +2465,21 @@
</xs:simpleType>
</xs:attribute>
</xs:attributeGroup>
<xs:element name="feature-policy">
<xs:annotation>
<xs:documentation>Adds support for Feature Policy</xs:documentation>
</xs:annotation>
<xs:complexType>
<xs:attributeGroup ref="security:feature-options.attlist"/>
</xs:complexType>
</xs:element>
<xs:attributeGroup name="feature-options.attlist">
<xs:attribute name="policy-directives" type="xs:token">
<xs:annotation>
<xs:documentation>The security policy directive(s) for the Feature-Policy header.</xs:documentation>
</xs:annotation>
</xs:attribute>
</xs:attributeGroup>
<xs:element name="cache-control">
<xs:annotation>
<xs:documentation>Adds Cache-Control no-cache, no-store, must-revalidate, Pragma no-cache, and Expires 0 for
@@ -2719,4 +2735,4 @@
<xs:enumeration value="LAST"/>
</xs:restriction>
</xs:simpleType>
</xs:schema>
</xs:schema>