From ce5ee75c6b0d1789cb55b20bf4ce95d0d2f900b4 Mon Sep 17 00:00:00 2001 From: Gsealy Date: Sat, 14 Dec 2019 23:55:47 +0800 Subject: [PATCH 1/2] document SecureHeadersGatewayFilterFactory (#1437) Documents how to disable specific headers. Fixes gh-1417 --- docs/src/main/asciidoc/spring-cloud-gateway.adoc | 16 ++++++++++++++-- 1 file changed, 14 insertions(+), 2 deletions(-) diff --git a/docs/src/main/asciidoc/spring-cloud-gateway.adoc b/docs/src/main/asciidoc/spring-cloud-gateway.adoc index 74e41478..bd6d47b7 100644 --- a/docs/src/main/asciidoc/spring-cloud-gateway.adoc +++ b/docs/src/main/asciidoc/spring-cloud-gateway.adoc @@ -889,7 +889,7 @@ If you are integrating https://projects.spring.io/spring-security/[Spring Securi === SecureHeaders GatewayFilter Factory The SecureHeaders GatewayFilter Factory adds a number of headers to the response at the recommendation from https://blog.appcanary.com/2017/http-security-headers.html[this blog post]. -.The following headers are added (allong with default values): +.The following headers are added (along with default values): * `X-Xss-Protection:1; mode=block` * `Strict-Transport-Security:max-age=631138519` * `X-Frame-Options:DENY` @@ -913,8 +913,20 @@ To change the default values set the appropriate property in the `spring.cloud.g To disable the default values set the property `spring.cloud.gateway.filter.secure-headers.disable` with comma separated values. +NOTE: Need use lowercase and full name of secure headers. + +.The following values can use: + * `x-xss-protection` + * `strict-transport-security` + * `x-frame-options` + * `x-content-type-options` + * `referrer-policy` + * `content-security-policy` + * `x-download-options` + * `x-permitted-cross-domain-policies` + .Example: -`spring.cloud.gateway.filter.secure-headers.disable=frame-options,download-options` +`spring.cloud.gateway.filter.secure-headers.disable=x-frame-options,strict-transport-security` === SetPath GatewayFilter Factory The SetPath GatewayFilter Factory takes a path `template` parameter. It offers a simple way to manipulate the request path by allowing templated segments of the path. This uses the uri templates from Spring Framework. Multiple matching segments are allowed. From ff054309ecf04f5e049b40533cd2dedabf38d0aa Mon Sep 17 00:00:00 2001 From: Denis Zavedeev Date: Sat, 30 Nov 2019 13:34:41 +0300 Subject: [PATCH 2/2] Fix some typos in documentation In particular: - add missing `new` operator - ensure that `RouteDefinitionLocators` is properly formatted in the "Configuration" section - "Normwal" -> "Normal" - remove extra "`" --- docs/src/main/asciidoc/spring-cloud-gateway.adoc | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/docs/src/main/asciidoc/spring-cloud-gateway.adoc b/docs/src/main/asciidoc/spring-cloud-gateway.adoc index bd6d47b7..41a29736 100644 --- a/docs/src/main/asciidoc/spring-cloud-gateway.adoc +++ b/docs/src/main/asciidoc/spring-cloud-gateway.adoc @@ -1226,7 +1226,7 @@ As Spring Cloud Gateway distinguishes between "pre" and "post" phases for filter ---- @Bean public GlobalFilter customFilter() { - return CustomGlobalFilter(); + return new CustomGlobalFilter(); } public class CustomGlobalFilter implements GlobalFilter, Ordered { @@ -1324,7 +1324,7 @@ The `NettyWriteResponseFilter` runs if there is a Netty `HttpClientResponse` in === RouteToRequestUrl Filter -The `RouteToRequestUrlFilter` runs if there is a `Route` object in the `ServerWebExchangeUtils.GATEWAY_ROUTE_ATTR` exchange attribute. It creates a new URI, based off of the request URI, but updated with the URI attribute of the `Route` object. The new URI is placed in the `ServerWebExchangeUtils.GATEWAY_REQUEST_URL_ATTR` exchange attribute`. +The `RouteToRequestUrlFilter` runs if there is a `Route` object in the `ServerWebExchangeUtils.GATEWAY_ROUTE_ATTR` exchange attribute. It creates a new URI, based off of the request URI, but updated with the URI attribute of the `Route` object. The new URI is placed in the `ServerWebExchangeUtils.GATEWAY_REQUEST_URL_ATTR` exchange attribute. If the URI has a scheme prefix, such as `lb:ws://serviceid`, the `lb` scheme is stripped from the URI and placed in the `ServerWebExchangeUtils.GATEWAY_SCHEME_PREFIX_ATTR` for use later in the filter chain. @@ -1348,7 +1348,7 @@ spring: uri: http://localhost:3001 predicates: - Path=/websocket/info/** - # Normwal Websocket route + # Normal Websocket route - id: websocket_route uri: ws://localhost:3001 predicates: @@ -1444,7 +1444,7 @@ spring: == Configuration -Configuration for Spring Cloud Gateway is driven by a collection of `RouteDefinitionLocator`s. +Configuration for Spring Cloud Gateway is driven by a collection of ``RouteDefinitionLocator``s. .RouteDefinitionLocator.java [source,java]