SpringCloud/spring-cloud-gateway
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Removes secureheaders.adoc since that is functionality in spring security for MVC

Browse Source
This commit is contained in:
sgibb
2023-12-05 13:09:23 -05:00
parent 063ded5a14
commit 9ad7b07ed7
2 changed files with 0 additions and 39 deletions
Download Patch File Download Diff File Expand all files Collapse all files

1
docs/modules/ROOT/nav.adoc
View File

@@ -97,7 +97,6 @@
//*** xref:spring-cloud-gateway-server-mvc/filters/rewriterequestparameter.adoc[]
*** xref:spring-cloud-gateway-server-mvc/filters/rewriteresponseheader.adoc[]
//*** xref:spring-cloud-gateway-server-mvc/filters/savesession.adoc[]
//*** xref:spring-cloud-gateway-server-mvc/filters/secureheaders.adoc[]
*** xref:spring-cloud-gateway-server-mvc/filters/setpath.adoc[]
*** xref:spring-cloud-gateway-server-mvc/filters/setrequestheader.adoc[]
*** xref:spring-cloud-gateway-server-mvc/filters/setresponseheader.adoc[]

38
docs/modules/ROOT/pages/spring-cloud-gateway-server-mvc/filters/secureheaders.adoc
View File

@@ -1,38 +0,0 @@
[[secureheaders-filter]]
= `SecureHeaders` Filter
The `SecureHeaders` filter adds a number of headers to the response, per the recommendation made in https://blog.appcanary.com/2017/http-security-headers.html[this blog post].
The following headers (shown with their default values) are added:
* `X-Xss-Protection:1 (mode=block`)
* `Strict-Transport-Security (max-age=631138519`)
* `X-Frame-Options (DENY)`
* `X-Content-Type-Options (nosniff)`
* `Referrer-Policy (no-referrer)`
* `Content-Security-Policy (default-src 'self' https:; font-src 'self' https: data:; img-src 'self' https: data:; object-src 'none'; script-src https:; style-src 'self' https: 'unsafe-inline)'`
* `X-Download-Options (noopen)`
* `X-Permitted-Cross-Domain-Policies (none)`
To change the default values, set the appropriate property in the `spring.cloud.gateway.filter.secure-headers` namespace.
The following properties are available:
* `xss-protection-header`
* `strict-transport-security`
* `frame-options`
* `content-type-options`
* `referrer-policy`
* `content-security-policy`
* `download-options`
* `permitted-cross-domain-policies`
To disable the default values set the `spring.cloud.gateway.filter.secure-headers.disable` property with comma-separated values.
The following example shows how to do so:
[source]
----
spring.cloud.gateway.filter.secure-headers.disable=x-frame-options,strict-transport-security
----
NOTE: The lowercase full name of the secure header needs to be used to disable it..