SpringCloud/spring-cloud-gateway
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Fixes gh-878 - secure headers can be disabled

Browse Source
This commit is contained in:
Thirunavukkarasu Ravichandran
2019-05-04 09:59:44 +02:00
committed by Thirunavukkarasu Ravichandran
parent 659313816b
commit ee6f7d01c4
4 changed files with 176 additions and 16 deletions
Download Patch File Download Diff File Expand all files Collapse all files

6
docs/src/main/asciidoc/spring-cloud-gateway.adoc
View File

@@ -790,7 +790,7 @@ spring:
If you are integrating https://projects.spring.io/spring-security/[Spring Security] with Spring Session, and want to ensure security details have been forwarded to the remote process, this is critical.
=== SecureHeaders GatewayFilter Factory
The SecureHeaders GatewayFilter Factory adds a number of headers to the response at the reccomendation from https://blog.appcanary.com/2017/http-security-headers.html[this blog post].
The SecureHeaders GatewayFilter Factory adds a number of headers to the response at the recommendation from https://blog.appcanary.com/2017/http-security-headers.html[this blog post].
.The following headers are added (allong with default values):
* `X-Xss-Protection:1; mode=block`
@@ -814,6 +814,10 @@ To change the default values set the appropriate property in the `spring.cloud.g
* `download-options`
* `permitted-cross-domain-policies`
To disable the default values set the property `spring.cloud.gateway.filter.secure-headers.disable` with comma separated values.
.Example:
`spring.cloud.gateway.filter.secure-headers.disable=frame-options,download-options`
=== SetPath GatewayFilter Factory
The SetPath GatewayFilter Factory takes a path `template` parameter. It offers a simple way to manipulate the request path by allowing templated segments of the path. This uses the uri templates from Spring Framework. Multiple matching segments are allowed.