Spring/spring-security
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

SEC-2230: HTTP Strict Transport Security (HSTS)Add support for Strict

Browse Source 
This is a distinct filter as apposed to reusing StaticHeaderWriter
since the specification specifies that the "Strict-Transport-Security"
header should only be set on secure requests. It would not make sense to
require DelegatingRequestMatcherHeaderWriter since this requirement is
in the specification.
This commit is contained in:
Rob Winch
2013-07-29 18:22:28 -05:00
parent 8013cd54d6
commit c85328c5d1
7 changed files with 416 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

15
config/src/main/resources/org/springframework/security/config/spring-security-3.2.rnc
View File

@@ -720,7 +720,20 @@ jdbc-user-service.attlist &=
headers =
## Element for configuration of the AddHeadersFilter. Enables easy setting for the X-Frame-Options, X-XSS-Protection and X-Content-Type-Options headers.
element headers {cache-control? & xss-protection? & frame-options? & content-type-options? & header*}
element headers {cache-control? & xss-protection? & hsts? & frame-options? & content-type-options? & header*}
hsts =
## Adds support for HTTP Strict Transport Security (HSTS)
element hsts {hsts-options.attlist}
hsts-options.attlist &=
## Specifies if subdomains should be included. Default true.
attribute include-subdomains {xsd:boolean}?
hsts-options.attlist &=
## Specifies the maximum ammount of time the host should be considered a Known HSTS Host. Default one year.
attribute max-age-seconds {xsd:integer}?
hsts-options.attlist &=
## The RequestMatcher instance to be used to determine if the header should be set. Default is if HttpServletRequest.isSecure() is true.
attribute request-matcher-ref { xsd:token }?
cache-control =
## Adds Cache-Control no-cache, no-store, must-revalidate and Pragma no-cache every URL

32
config/src/main/resources/org/springframework/security/config/spring-security-3.2.xsd
View File

@@ -2242,12 +2242,44 @@
<xs:choice minOccurs="0" maxOccurs="unbounded">
<xs:element ref="security:cache-control"/>
<xs:element ref="security:xss-protection"/>
<xs:element ref="security:hsts"/>
<xs:element ref="security:frame-options"/>
<xs:element ref="security:content-type-options"/>
<xs:element ref="security:header"/>
</xs:choice>
</xs:complexType>
</xs:element>
<xs:element name="hsts">
<xs:annotation>
<xs:documentation>Adds support for HTTP Strict Transport Security (HSTS)
</xs:documentation>
</xs:annotation>
<xs:complexType>
<xs:attributeGroup ref="security:hsts-options.attlist"/>
</xs:complexType>
</xs:element>
<xs:attributeGroup name="hsts-options.attlist">
<xs:attribute name="include-subdomains" type="xs:boolean">
<xs:annotation>
<xs:documentation>Specifies if subdomains should be included. Default true.
</xs:documentation>
</xs:annotation>
</xs:attribute>
<xs:attribute name="max-age-seconds" type="xs:integer">
<xs:annotation>
<xs:documentation>Specifies the maximum ammount of time the host should be considered a Known HSTS Host.
Default one year.
</xs:documentation>
</xs:annotation>
</xs:attribute>
<xs:attribute name="request-matcher-ref" type="xs:token">
<xs:annotation>
<xs:documentation>The RequestMatcher instance to be used to determine if the header should be set. Default
is if HttpServletRequest.isSecure() is true.
</xs:documentation>
</xs:annotation>
</xs:attribute>
</xs:attributeGroup>
<xs:element name="cache-control">
<xs:annotation>
<xs:documentation>Adds Cache-Control no-cache, no-store, must-revalidate and Pragma no-cache every URL