From 9ad7b07ed750508c65e07fa049cc7f8434363cff Mon Sep 17 00:00:00 2001 From: sgibb Date: Tue, 5 Dec 2023 13:09:23 -0500 Subject: [PATCH] Removes secureheaders.adoc since that is functionality in spring security for MVC --- docs/modules/ROOT/nav.adoc | 1 - .../filters/secureheaders.adoc | 38 ------------------- 2 files changed, 39 deletions(-) delete mode 100644 docs/modules/ROOT/pages/spring-cloud-gateway-server-mvc/filters/secureheaders.adoc diff --git a/docs/modules/ROOT/nav.adoc b/docs/modules/ROOT/nav.adoc index 7f1c0280..25236469 100644 --- a/docs/modules/ROOT/nav.adoc +++ b/docs/modules/ROOT/nav.adoc @@ -97,7 +97,6 @@ //*** xref:spring-cloud-gateway-server-mvc/filters/rewriterequestparameter.adoc[] *** xref:spring-cloud-gateway-server-mvc/filters/rewriteresponseheader.adoc[] //*** xref:spring-cloud-gateway-server-mvc/filters/savesession.adoc[] -//*** xref:spring-cloud-gateway-server-mvc/filters/secureheaders.adoc[] *** xref:spring-cloud-gateway-server-mvc/filters/setpath.adoc[] *** xref:spring-cloud-gateway-server-mvc/filters/setrequestheader.adoc[] *** xref:spring-cloud-gateway-server-mvc/filters/setresponseheader.adoc[] diff --git a/docs/modules/ROOT/pages/spring-cloud-gateway-server-mvc/filters/secureheaders.adoc b/docs/modules/ROOT/pages/spring-cloud-gateway-server-mvc/filters/secureheaders.adoc deleted file mode 100644 index 9c2028ce..00000000 --- a/docs/modules/ROOT/pages/spring-cloud-gateway-server-mvc/filters/secureheaders.adoc +++ /dev/null @@ -1,38 +0,0 @@ -[[secureheaders-filter]] -= `SecureHeaders` Filter - -The `SecureHeaders` filter adds a number of headers to the response, per the recommendation made in https://blog.appcanary.com/2017/http-security-headers.html[this blog post]. - -The following headers (shown with their default values) are added: - -* `X-Xss-Protection:1 (mode=block`) -* `Strict-Transport-Security (max-age=631138519`) -* `X-Frame-Options (DENY)` -* `X-Content-Type-Options (nosniff)` -* `Referrer-Policy (no-referrer)` -* `Content-Security-Policy (default-src 'self' https:; font-src 'self' https: data:; img-src 'self' https: data:; object-src 'none'; script-src https:; style-src 'self' https: 'unsafe-inline)'` -* `X-Download-Options (noopen)` -* `X-Permitted-Cross-Domain-Policies (none)` - -To change the default values, set the appropriate property in the `spring.cloud.gateway.filter.secure-headers` namespace. -The following properties are available: - -* `xss-protection-header` -* `strict-transport-security` -* `frame-options` -* `content-type-options` -* `referrer-policy` -* `content-security-policy` -* `download-options` -* `permitted-cross-domain-policies` - -To disable the default values set the `spring.cloud.gateway.filter.secure-headers.disable` property with comma-separated values. -The following example shows how to do so: - -[source] ----- -spring.cloud.gateway.filter.secure-headers.disable=x-frame-options,strict-transport-security ----- - -NOTE: The lowercase full name of the secure header needs to be used to disable it.. -