SEC-2098, SEC-2099: Created HeadersFilter

Created HeadersFilter for setting security headers added including a
bean definition parser for easy configuration of the headers. Enables
easy configuration for the X-Frame-Options, X-XSS-Protection and
X-Content-Type-Options headers. Also allows for additional headers to
be added.

web/src/main/java/org/springframework/security/web/headers/HeadersFilter.java

@@ -0,0 +1,62 @@
+/*
+ * Copyright 2002-2012 the original author or authors.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.springframework.security.web.headers;
+
+import org.springframework.web.filter.OncePerRequestFilter;
+
+import javax.servlet.FilterChain;
+import javax.servlet.ServletException;
+import javax.servlet.http.HttpServletRequest;
+import javax.servlet.http.HttpServletResponse;
+import java.io.IOException;
+import java.util.HashMap;
+import java.util.Map;
+
+/**
+ * Filter implementation to add headers to the current request. Can be useful to add certain headers which enable
+ * browser protection. Like X-Frame-Options, X-XSS-Protection and X-Content-Type-Options.
+ *
+ * @author Marten Deinum
+ * @since 3.2
+ *
+ */
+public class HeadersFilter extends OncePerRequestFilter {
+
+    /** Map of headers to add to a response */
+    private final Map<String, String> headers = new HashMap<String, String>();
+
+    @Override
+    protected void doFilterInternal(HttpServletRequest request, HttpServletResponse response, FilterChain filterChain) throws ServletException, IOException {
+        for (Map.Entry<String, String> header : headers.entrySet()) {
+            String name = header.getKey();
+            String value = header.getValue();
+            if (logger.isTraceEnabled()) {
+                logger.trace("Adding header '" + name + "' with value '"+value +"'");
+            }
+            response.setHeader(header.getKey(), header.getValue());
+        }
+        filterChain.doFilter(request, response);
+    }
+
+    public void setHeaders(Map<String, String> headers) {
+        this.headers.clear();
+        this.headers.putAll(headers);
+    }
+
+    public void addHeader(String name, String value) {
+        headers.put(name, value);
+    }
+}

web/src/test/java/org/springframework/security/web/headers/HeadersFilterTest.java

@@ -0,0 +1,73 @@
+/*
+ * Copyright 2002-2013 the original author or authors.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.springframework.security.web.headers;
+
+import org.junit.Test;
+import org.springframework.mock.web.MockFilterChain;
+import org.springframework.mock.web.MockHttpServletRequest;
+import org.springframework.mock.web.MockHttpServletResponse;
+
+import java.util.Collection;
+import java.util.HashMap;
+import java.util.Map;
+
+import static org.hamcrest.CoreMatchers.is;
+import static org.junit.Assert.assertThat;
+import static org.junit.Assert.assertTrue;
+import static org.junit.matchers.JUnitMatchers.hasItems;
+
+/**
+ * Tests for the {@code HeadersFilter}
+ *
+ * @author Marten Deinum
+ * @since 3.2
+ */
+public class HeadersFilterTest {
+
+    @Test
+    public void noHeadersConfigured() throws Exception {
+        HeadersFilter filter = new HeadersFilter();
+        MockHttpServletRequest request = new MockHttpServletRequest();
+        MockHttpServletResponse response = new MockHttpServletResponse();
+        MockFilterChain filterChain = new MockFilterChain();
+
+        filter.doFilter(request, response, filterChain);
+
+        assertTrue(response.getHeaderNames().isEmpty());
+    }
+
+    @Test
+    public void additionalHeadersShouldBeAddedToTheResponse() throws Exception {
+        HeadersFilter filter = new HeadersFilter();
+        Map<String, String> headers = new HashMap<String, String>();
+        headers.put("X-Header1", "foo");
+        headers.put("X-Header2", "bar");
+        filter.setHeaders(headers);
+
+        MockHttpServletRequest request = new MockHttpServletRequest();
+        MockHttpServletResponse response = new MockHttpServletResponse();
+        MockFilterChain filterChain = new MockFilterChain();
+
+        filter.doFilter(request, response, filterChain);
+
+        Collection<String> headerNames = response.getHeaderNames();
+        assertThat(headerNames.size(), is(2));
+        assertThat(headerNames, hasItems("X-Header1", "X-Header2"));
+        assertThat(response.getHeader("X-Header1"), is("foo"));
+        assertThat(response.getHeader("X-Header2"), is("bar"));
+
+    }
+}