SEC-2230: Add Header JavaConfig

Added JavaConfig for Headers. In the process, more HeaderWriter instances
were added so that we can reuse logic between the XML and JavaConfig. This
also prompted repackaging the writers.

web/src/main/java/org/springframework/security/web/header/Header.java

@@ -1,4 +1,4 @@
-package org.springframework.security.web.headers;
+package org.springframework.security.web.header;
 
 import java.util.Arrays;
 import java.util.List;

web/src/main/java/org/springframework/security/web/header/HeaderWriter.java

@@ -13,7 +13,7 @@
  * See the License for the specific language governing permissions and
  * limitations under the License.
  */
-package org.springframework.security.web.headers;
+package org.springframework.security.web.header;
 
 import javax.servlet.http.HttpServletRequest;
 import javax.servlet.http.HttpServletResponse;
@@ -21,7 +21,7 @@ import javax.servlet.http.HttpServletResponse;
 /**
  * Contract for writing headers to a {@link HttpServletResponse}
  *
- * @see HeadersFilter
+ * @see HeaderWriterFilter
  *
  * @author Marten Deinum
  * @author Rob Winch

web/src/main/java/org/springframework/security/web/header/HeaderWriterFilter.java

@@ -13,7 +13,7 @@
  * See the License for the specific language governing permissions and
  * limitations under the License.
  */
-package org.springframework.security.web.headers;
+package org.springframework.security.web.header;
 
 import org.springframework.util.Assert;
 import org.springframework.web.filter.OncePerRequestFilter;
@@ -33,7 +33,7 @@ import java.util.*;
  * @since 3.2
  *
  */
-public class HeadersFilter extends OncePerRequestFilter {
+public class HeaderWriterFilter extends OncePerRequestFilter {
 
     /** Collection of {@link HeaderWriter} instances to  write out the headers to the response . */
     private final List<HeaderWriter> headerWriters;
@@ -43,7 +43,7 @@ public class HeadersFilter extends OncePerRequestFilter {
      *
      * @param headerWriters the {@link HeaderWriter} instances to write out headers to the {@link HttpServletResponse}.
      */
-    public HeadersFilter(List<HeaderWriter> headerWriters) {
+    public HeaderWriterFilter(List<HeaderWriter> headerWriters) {
         Assert.notEmpty(headerWriters, "headerWriters cannot be null");
         this.headerWriters = headerWriters;
     }

web/src/main/java/org/springframework/security/web/header/writers/CacheControlHeadersWriter.java

@@ -0,0 +1,49 @@
+/*
+ * Copyright 2002-2013 the original author or authors.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.springframework.security.web.header.writers;
+
+import java.util.ArrayList;
+import java.util.List;
+
+import org.springframework.security.web.header.Header;
+
+/**
+ * A {@link StaticHeadersWriter} that inserts headers to prevent caching.
+ * Specifically it adds the following headers:
+ * <ul>
+ * <li>Cache-Control: no-cache, no-store, max-age=0, must-revalidate</li>
+ * <li>Pragma: no-cache</li>
+ * </ul>
+ *
+ * @author Rob Winch
+ * @since 3.2
+ */
+public final class CacheControlHeadersWriter extends StaticHeadersWriter {
+
+    /**
+     * Creates a new instance
+     */
+    public CacheControlHeadersWriter() {
+        super(createHeaders());
+    }
+
+    private static List<Header> createHeaders() {
+        List<Header> headers = new ArrayList<Header>(2);
+        headers.add(new Header("Cache-Control","no-cache","no-store","max-age=0","must-revalidate"));
+        headers.add(new Header("Pragma","no-cache"));
+        return headers;
+    }
+}

web/src/main/java/org/springframework/security/web/header/writers/DelegatingRequestMatcherHeaderWriter.java

@@ -13,11 +13,12 @@
  * See the License for the specific language governing permissions and
  * limitations under the License.
  */
-package org.springframework.security.web.headers;
+package org.springframework.security.web.header.writers;
 
 import javax.servlet.http.HttpServletRequest;
 import javax.servlet.http.HttpServletResponse;
 
+import org.springframework.security.web.header.HeaderWriter;
 import org.springframework.security.web.util.RequestMatcher;
 import org.springframework.util.Assert;
 

web/src/main/java/org/springframework/security/web/header/writers/HstsHeaderWriter.java

@@ -13,13 +13,14 @@
  * See the License for the specific language governing permissions and
  * limitations under the License.
  */
-package org.springframework.security.web.headers;
+package org.springframework.security.web.header.writers;
 
 import javax.servlet.http.HttpServletRequest;
 import javax.servlet.http.HttpServletResponse;
 
 import org.apache.commons.logging.Log;
 import org.apache.commons.logging.LogFactory;
+import org.springframework.security.web.header.HeaderWriter;
 import org.springframework.security.web.util.RequestMatcher;
 import org.springframework.util.Assert;
 
@@ -48,11 +49,13 @@ import org.springframework.util.Assert;
  * @since 3.2
  */
 public final class HstsHeaderWriter implements HeaderWriter {
+    private static final long DEFAULT_MAX_AGE_SECONDS = 31536000;
+
     private static final String HSTS_HEADER_NAME = "Strict-Transport-Security";
 
     private final Log logger = LogFactory.getLog(getClass());
 
-    private RequestMatcher requestMatcher = new SecureRequestMatcher();
+    private RequestMatcher requestMatcher;
 
     private long maxAgeInSeconds;
 
@@ -60,12 +63,57 @@ public final class HstsHeaderWriter implements HeaderWriter {
 
     private String hstsHeaderValue;
 
-    public HstsHeaderWriter() {
-        this.maxAgeInSeconds = 31536000;
-        this.includeSubDomains = true;
+    /**
+     * Creates a new instance
+     *
+     * @param requestMatcher maps to {@link #setRequestMatcher(RequestMatcher)}
+     * @param maxAgeInSeconds maps to {@link #setMaxAgeInSeconds(long)}
+     * @param includeSubDomains maps to {@link #setIncludeSubDomains(boolean)}
+     */
+    public HstsHeaderWriter(RequestMatcher requestMatcher,
+            long maxAgeInSeconds, boolean includeSubDomains) {
+        super();
+        this.requestMatcher = requestMatcher;
+        this.maxAgeInSeconds = maxAgeInSeconds;
+        this.includeSubDomains = includeSubDomains;
         updateHstsHeaderValue();
     }
 
+    /**
+     * Creates a new instance
+     *
+     * @param maxAgeInSeconds maps to {@link #setMaxAgeInSeconds(long)}
+     * @param includeSubDomains maps to {@link #setIncludeSubDomains(boolean)}
+     */
+    public HstsHeaderWriter(long maxAgeInSeconds, boolean includeSubDomains) {
+        this(new SecureRequestMatcher(),maxAgeInSeconds,includeSubDomains);
+    }
+
+    /**
+     * Creates a new instance
+     *
+     * @param maxAgeInSeconds maps to {@link #setMaxAgeInSeconds(long)}
+     */
+    public HstsHeaderWriter(long maxAgeInSeconds) {
+        this(new SecureRequestMatcher(),maxAgeInSeconds,true);
+    }
+
+    /**
+     * Creates a new instance
+     *
+     * @param includeSubDomains maps to {@link #setIncludeSubDomains(boolean)}
+     */
+    public HstsHeaderWriter(boolean includeSubDomains) {
+        this(new SecureRequestMatcher(),DEFAULT_MAX_AGE_SECONDS,includeSubDomains);
+    }
+
+    /**
+     * Creates a new instance
+     */
+    public HstsHeaderWriter() {
+        this(DEFAULT_MAX_AGE_SECONDS);
+    }
+
     /*
      * (non-Javadoc)
      *

web/src/main/java/org/springframework/security/web/header/writers/StaticHeadersWriter.java

@@ -1,4 +1,4 @@
-package org.springframework.security.web.headers;
+package org.springframework.security.web.header.writers;
 
 import java.util.Collections;
 import java.util.List;
@@ -6,6 +6,8 @@ import java.util.List;
 import javax.servlet.http.HttpServletRequest;
 import javax.servlet.http.HttpServletResponse;
 
+import org.springframework.security.web.header.Header;
+import org.springframework.security.web.header.HeaderWriter;
 import org.springframework.util.Assert;
 
 /**

web/src/main/java/org/springframework/security/web/header/writers/XContentTypeOptionsHeaderWriter.java

@@ -0,0 +1,37 @@
+/*
+ * Copyright 2002-2013 the original author or authors.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.springframework.security.web.header.writers;
+
+
+/**
+ * A {@link StaticHeadersWriter} that inserts headers to prevent content
+ * sniffing. Specifically the following headers are set:
+ * <ul>
+ * <li>X-Content-Type-Options: nosniff</li>
+ * </ul>
+ *
+ * @author Rob Winch
+ * @since 3.2
+ */
+public final class XContentTypeOptionsHeaderWriter extends StaticHeadersWriter {
+
+    /**
+     * Creates a new instance
+     */
+    public XContentTypeOptionsHeaderWriter() {
+        super("X-Content-Type-Options","nosniff");
+    }
+}

web/src/main/java/org/springframework/security/web/header/writers/XXssProtectionHeaderWriter.java

@@ -0,0 +1,118 @@
+/*
+ * Copyright 2002-2013 the original author or authors.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.springframework.security.web.header.writers;
+
+import javax.servlet.http.HttpServletRequest;
+import javax.servlet.http.HttpServletResponse;
+
+import org.springframework.security.web.header.HeaderWriter;
+
+/**
+ * Renders the <a href=
+ * "http://blogs.msdn.com/b/ieinternals/archive/2011/01/31/controlling-the-internet-explorer-xss-filter-with-the-x-xss-protection-http-header.aspx"
+ * >X-XSS-Protection header</a>.
+ *
+ * @author Rob Winch
+ * @since 3.2
+ */
+public final class XXssProtectionHeaderWriter implements HeaderWriter {
+    private static final String XSS_PROTECTION_HEADER = "X-XSS-Protection";
+
+    private boolean enabled;
+
+    private boolean block;
+
+    private String headerValue;
+
+    /**
+     * Create a new instance
+     */
+    public XXssProtectionHeaderWriter() {
+        this.enabled = true;
+        this.block = true;
+        updateHeaderValue();
+    }
+
+    @Override
+    public void writeHeaders(HttpServletRequest request,
+            HttpServletResponse response) {
+        response.setHeader(XSS_PROTECTION_HEADER, headerValue);
+    }
+
+    /**
+     * If true, will contain a value of 1. For example:
+     *
+     * <pre>
+     * X-XSS-Protection: 1
+     * </pre>
+     *
+     * or if {@link #setBlock(boolean)} is true
+     *
+     *
+     * <pre>
+     * X-XSS-Protection: 1; mode=block
+     * </pre>
+     *
+     * If false, will explicitly disable specify that X-XSS-Protection is
+     * disabled. For example:
+     *
+     * <pre>
+     * X-XSS-Protection: 0
+     * </pre>
+     *
+     * @param enabled the new value
+     */
+    public void setEnabled(boolean enabled) {
+        if(!enabled) {
+            setBlock(false);
+        }
+        this.enabled = enabled;
+        updateHeaderValue();
+    }
+
+
+    /**
+     * If false, will not specify the mode as blocked. In this instance, any
+     * content will be attempted to be fixed. If true, the content will be
+     * replaced with "#".
+     *
+     * @param enabled
+     *            the new value
+     */
+    public void setBlock(boolean block) {
+        if(!enabled && block) {
+            throw new IllegalArgumentException("Cannot set block to true with enabled false");
+        }
+        this.block = block;
+        updateHeaderValue();
+    }
+
+    private void updateHeaderValue() {
+        if(!enabled) {
+            this.headerValue = "0";
+            return;
+        }
+        this.headerValue = "1";
+        if(block) {
+            this.headerValue += "; mode=block";
+        }
+    }
+
+    @Override
+    public String toString() {
+        return getClass().getName() + " [headerValue=" + headerValue + "]";
+    }
+}

web/src/main/java/org/springframework/security/web/header/writers/frameoptions/AbstractRequestParameterAllowFromStrategy.java

@@ -1,4 +1,4 @@
-package org.springframework.security.web.headers.frameoptions;
+package org.springframework.security.web.header.writers.frameoptions;
 
 import org.apache.commons.logging.Log;
 import org.apache.commons.logging.LogFactory;

web/src/main/java/org/springframework/security/web/header/writers/frameoptions/AllowFromStrategy.java

@@ -1,4 +1,4 @@
-package org.springframework.security.web.headers.frameoptions;
+package org.springframework.security.web.header.writers.frameoptions;
 
 import javax.servlet.http.HttpServletRequest;
 

web/src/main/java/org/springframework/security/web/header/writers/frameoptions/RegExpAllowFromStrategy.java

@@ -1,4 +1,4 @@
-package org.springframework.security.web.headers.frameoptions;
+package org.springframework.security.web.header.writers.frameoptions;
 
 import org.springframework.util.Assert;
 

web/src/main/java/org/springframework/security/web/header/writers/frameoptions/StaticAllowFromStrategy.java

@@ -1,4 +1,4 @@
-package org.springframework.security.web.headers.frameoptions;
+package org.springframework.security.web.header.writers.frameoptions;
 
 import javax.servlet.http.HttpServletRequest;
 import java.net.URI;

web/src/main/java/org/springframework/security/web/header/writers/frameoptions/WhiteListedAllowFromStrategy.java

@@ -1,4 +1,4 @@
-package org.springframework.security.web.headers.frameoptions;
+package org.springframework.security.web.header.writers.frameoptions;
 
 import java.util.Collection;
 

web/src/main/java/org/springframework/security/web/header/writers/frameoptions/XFrameOptionsHeaderWriter.java

@@ -13,9 +13,9 @@
  * See the License for the specific language governing permissions and
  * limitations under the License.
  */
-package org.springframework.security.web.headers.frameoptions;
+package org.springframework.security.web.header.writers.frameoptions;
 
-import org.springframework.security.web.headers.HeaderWriter;
+import org.springframework.security.web.header.HeaderWriter;
 import org.springframework.util.Assert;
 
 import javax.servlet.http.HttpServletRequest;
@@ -38,6 +38,13 @@ public class XFrameOptionsHeaderWriter implements HeaderWriter {
     private final AllowFromStrategy allowFromStrategy;
     private final XFrameOptionsMode frameOptionsMode;
 
+    /**
+     * Creates an instance with {@link XFrameOptionsMode#DENY}
+     */
+    public XFrameOptionsHeaderWriter() {
+        this(XFrameOptionsMode.DENY);
+    }
+
     /**
      * Creates a new instance
      *

web/src/test/java/org/springframework/security/web/header/HeaderWriterFilterTests.java

@@ -13,7 +13,7 @@
  * See the License for the specific language governing permissions and
  * limitations under the License.
  */
-package org.springframework.security.web.headers;
+package org.springframework.security.web.header;
 
 import static org.fest.assertions.Assertions.assertThat;
 import static org.mockito.Mockito.verify;
@@ -28,6 +28,8 @@ import org.mockito.runners.MockitoJUnitRunner;
 import org.springframework.mock.web.MockFilterChain;
 import org.springframework.mock.web.MockHttpServletRequest;
 import org.springframework.mock.web.MockHttpServletResponse;
+import org.springframework.security.web.header.HeaderWriter;
+import org.springframework.security.web.header.HeaderWriterFilter;
 
 /**
  * Tests for the {@code HeadersFilter}
@@ -37,7 +39,7 @@ import org.springframework.mock.web.MockHttpServletResponse;
  * @since 3.2
  */
 @RunWith(MockitoJUnitRunner.class)
-public class HeadersFilterTests {
+public class HeaderWriterFilterTests {
     @Mock
     private HeaderWriter writer1;
 
@@ -47,12 +49,12 @@ public class HeadersFilterTests {
     @Test(expected = IllegalArgumentException.class)
     public void noHeadersConfigured() throws Exception {
         List<HeaderWriter> headerWriters = new ArrayList<HeaderWriter>();
-        new HeadersFilter(headerWriters);
+        new HeaderWriterFilter(headerWriters);
     }
 
     @Test(expected = IllegalArgumentException.class)
     public void constructorNullWriters() throws Exception {
-        new HeadersFilter(null);
+        new HeaderWriterFilter(null);
     }
 
     @Test
@@ -61,7 +63,7 @@ public class HeadersFilterTests {
         headerWriters.add(writer1);
         headerWriters.add(writer2);
 
-        HeadersFilter filter = new HeadersFilter(headerWriters);
+        HeaderWriterFilter filter = new HeaderWriterFilter(headerWriters);
 
         MockHttpServletRequest request = new MockHttpServletRequest();
         MockHttpServletResponse response = new MockHttpServletResponse();

web/src/test/java/org/springframework/security/web/header/writers/CacheControlHeadersWriterTests.java

@@ -0,0 +1,54 @@
+/*
+ * Copyright 2002-2013 the original author or authors.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.springframework.security.web.header.writers;
+
+import static org.fest.assertions.Assertions.assertThat;
+
+import java.util.Arrays;
+
+import org.junit.Before;
+import org.junit.Test;
+import org.springframework.mock.web.MockHttpServletRequest;
+import org.springframework.mock.web.MockHttpServletResponse;
+
+/**
+ * @author Rob Winch
+ *
+ */
+public class CacheControlHeadersWriterTests {
+
+    private MockHttpServletRequest request;
+
+    private MockHttpServletResponse response;
+
+    private CacheControlHeadersWriter writer;
+
+    @Before
+    public void setup() {
+        request = new MockHttpServletRequest();
+        response = new MockHttpServletResponse();
+        writer = new CacheControlHeadersWriter();
+    }
+
+    @Test
+    public void writeHeaders() {
+        writer.writeHeaders(request, response);
+
+        assertThat(response.getHeaderNames().size()).isEqualTo(2);
+        assertThat(response.getHeaderValues("Cache-Control")).isEqualTo(Arrays.asList("no-cache","no-store","max-age=0","must-revalidate"));
+        assertThat(response.getHeaderValues("Pragma")).isEqualTo(Arrays.asList("no-cache"));
+    }
+}

web/src/test/java/org/springframework/security/web/header/writers/DelegatingRequestMatcherHeaderWriterTests.java

@@ -13,9 +13,8 @@
  * See the License for the specific language governing permissions and
  * limitations under the License.
  */
-package org.springframework.security.web.headers;
+package org.springframework.security.web.header.writers;
 
-import static org.junit.Assert.fail;
 import static org.mockito.Mockito.times;
 import static org.mockito.Mockito.verify;
 import static org.mockito.Mockito.when;
@@ -27,6 +26,7 @@ import org.mockito.Mock;
 import org.mockito.runners.MockitoJUnitRunner;
 import org.springframework.mock.web.MockHttpServletRequest;
 import org.springframework.mock.web.MockHttpServletResponse;
+import org.springframework.security.web.header.HeaderWriter;
 import org.springframework.security.web.util.RequestMatcher;
 
 /**

web/src/test/java/org/springframework/security/web/header/writers/HstsHeaderWriterTests.java

@@ -0,0 +1,145 @@
+/*
+ * Copyright 2002-2013 the original author or authors.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.springframework.security.web.header.writers;
+
+import static org.fest.assertions.Assertions.assertThat;
+
+import org.junit.Before;
+import org.junit.Test;
+import org.springframework.mock.web.MockHttpServletRequest;
+import org.springframework.mock.web.MockHttpServletResponse;
+import org.springframework.security.web.header.writers.HstsHeaderWriter;
+import org.springframework.security.web.util.AnyRequestMatcher;
+
+/**
+ * @author Rob Winch
+ *
+ */
+public class HstsHeaderWriterTests {
+    private MockHttpServletRequest request;
+    private MockHttpServletResponse response;
+
+    private HstsHeaderWriter writer;
+
+    @Before
+    public void setup() {
+        request = new MockHttpServletRequest();
+        request.setSecure(true);
+        response = new MockHttpServletResponse();
+
+        writer = new HstsHeaderWriter();
+    }
+
+    @Test
+    public void allArgsCustomConstructorWriteHeaders() {
+        request.setSecure(false);
+        writer = new HstsHeaderWriter(new AnyRequestMatcher(), 15768000, false);
+
+        writer.writeHeaders(request, response);
+
+        assertThat(response.getHeaderNames().size()).isEqualTo(1);
+        assertThat(response.getHeader("Strict-Transport-Security")).isEqualTo("max-age=15768000");
+    }
+
+    @Test
+    public void maxAgeAndIncludeSubdomainsCustomConstructorWriteHeaders() {
+        request.setSecure(false);
+        writer = new HstsHeaderWriter(new AnyRequestMatcher(), 15768000, false);
+
+        writer.writeHeaders(request, response);
+
+        assertThat(response.getHeaderNames().size()).isEqualTo(1);
+        assertThat(response.getHeader("Strict-Transport-Security")).isEqualTo("max-age=15768000");
+    }
+
+    @Test
+    public void maxAgeCustomConstructorWriteHeaders() {
+        writer = new HstsHeaderWriter(15768000);
+
+        writer.writeHeaders(request, response);
+
+        assertThat(response.getHeaderNames().size()).isEqualTo(1);
+        assertThat(response.getHeader("Strict-Transport-Security")).isEqualTo("max-age=15768000 ; includeSubDomains");
+    }
+
+    @Test
+    public void includeSubDomainsCustomConstructorWriteHeaders() {
+        writer = new HstsHeaderWriter(false);
+
+        writer.writeHeaders(request, response);
+
+        assertThat(response.getHeaderNames().size()).isEqualTo(1);
+        assertThat(response.getHeader("Strict-Transport-Security")).isEqualTo("max-age=31536000");
+    }
+
+    @Test
+    public void writeHeadersDefaultValues() {
+        writer.writeHeaders(request, response);
+
+        assertThat(response.getHeaderNames().size()).isEqualTo(1);
+        assertThat(response.getHeader("Strict-Transport-Security")).isEqualTo("max-age=31536000 ; includeSubDomains");
+    }
+
+    @Test
+    public void writeHeadersIncludeSubDomainsFalse() {
+        writer.setIncludeSubDomains(false);
+
+        writer.writeHeaders(request, response);
+
+        assertThat(response.getHeaderNames().size()).isEqualTo(1);
+        assertThat(response.getHeader("Strict-Transport-Security")).isEqualTo("max-age=31536000");
+    }
+
+    @Test
+    public void writeHeadersCustomMaxAgeInSeconds() {
+        writer.setMaxAgeInSeconds(1);
+
+        writer.writeHeaders(request, response);
+
+        assertThat(response.getHeaderNames().size()).isEqualTo(1);
+        assertThat(response.getHeader("Strict-Transport-Security")).isEqualTo("max-age=1 ; includeSubDomains");
+    }
+
+    @Test
+    public void writeHeadersInsecureRequestDoesNotWriteHeader() {
+        request.setSecure(false);
+
+        writer.writeHeaders(request, response);
+
+        assertThat(response.getHeaderNames().isEmpty()).isTrue();
+    }
+
+    @Test
+    public void writeHeadersAnyRequestMatcher() {
+        writer.setRequestMatcher(new AnyRequestMatcher());
+        request.setSecure(false);
+
+        writer.writeHeaders(request, response);
+
+        assertThat(response.getHeaderNames().size()).isEqualTo(1);
+        assertThat(response.getHeader("Strict-Transport-Security")).isEqualTo("max-age=31536000 ; includeSubDomains");
+    }
+
+    @Test(expected = IllegalArgumentException.class)
+    public void setMaxAgeInSecondsToNegative() {
+        writer.setMaxAgeInSeconds(-1);
+    }
+
+    @Test(expected = IllegalArgumentException.class)
+    public void setRequestMatcherToNull() {
+        writer.setRequestMatcher(null);
+    }
+}

web/src/test/java/org/springframework/security/web/header/writers/StaticHeaderWriterTests.java

@@ -13,7 +13,7 @@
  * See the License for the specific language governing permissions and
  * limitations under the License.
  */
-package org.springframework.security.web.headers;
+package org.springframework.security.web.header.writers;
 
 import static org.fest.assertions.Assertions.assertThat;
 
@@ -24,6 +24,8 @@ import org.junit.Before;
 import org.junit.Test;
 import org.springframework.mock.web.MockHttpServletRequest;
 import org.springframework.mock.web.MockHttpServletResponse;
+import org.springframework.security.web.header.Header;
+import org.springframework.security.web.header.writers.StaticHeadersWriter;
 
 /**
  * Test for the {@code StaticHeadersWriter}

web/src/test/java/org/springframework/security/web/header/writers/XContentTypeOptionsHeaderWriterTests.java

@@ -0,0 +1,53 @@
+/*
+ * Copyright 2002-2013 the original author or authors.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.springframework.security.web.header.writers;
+
+import static org.fest.assertions.Assertions.assertThat;
+
+import java.util.Arrays;
+
+import org.junit.Before;
+import org.junit.Test;
+import org.springframework.mock.web.MockHttpServletRequest;
+import org.springframework.mock.web.MockHttpServletResponse;
+
+/**
+ * @author Rob Winch
+ *
+ */
+public class XContentTypeOptionsHeaderWriterTests {
+
+    private MockHttpServletRequest request;
+
+    private MockHttpServletResponse response;
+
+    private XContentTypeOptionsHeaderWriter writer;
+
+    @Before
+    public void setup() {
+        request = new MockHttpServletRequest();
+        response = new MockHttpServletResponse();
+        writer = new XContentTypeOptionsHeaderWriter();
+    }
+
+    @Test
+    public void writeHeaders() {
+        writer.writeHeaders(request, response);
+
+        assertThat(response.getHeaderNames().size()).isEqualTo(1);
+        assertThat(response.getHeaderValues("X-Content-Type-Options")).isEqualTo(Arrays.asList("nosniff"));
+    }
+}

web/src/test/java/org/springframework/security/web/header/writers/XXssProtectionHeaderWriterTests.java

@@ -13,10 +13,12 @@
  * See the License for the specific language governing permissions and
  * limitations under the License.
  */
-package org.springframework.security.web.headers;
+package org.springframework.security.web.header.writers;
 
 import static org.fest.assertions.Assertions.assertThat;
 
+import java.util.Arrays;
+
 import org.junit.Before;
 import org.junit.Test;
 import org.springframework.mock.web.MockHttpServletRequest;
@@ -26,65 +28,66 @@ import org.springframework.mock.web.MockHttpServletResponse;
  * @author Rob Winch
  *
  */
-public class HstsHeaderWriterTests {
+public class XXssProtectionHeaderWriterTests {
+
     private MockHttpServletRequest request;
+
     private MockHttpServletResponse response;
 
-    private HstsHeaderWriter writer;
+    private XXssProtectionHeaderWriter writer;
 
     @Before
     public void setup() {
         request = new MockHttpServletRequest();
-        request.setSecure(true);
         response = new MockHttpServletResponse();
-
-        writer = new HstsHeaderWriter();
+        writer = new XXssProtectionHeaderWriter();
     }
 
     @Test
-    public void writeHeadersDefaultValues() {
+    public void writeHeaders() {
         writer.writeHeaders(request, response);
 
         assertThat(response.getHeaderNames().size()).isEqualTo(1);
-        assertThat(response.getHeader("Strict-Transport-Security")).isEqualTo("max-age=31536000 ; includeSubDomains");
+        assertThat(response.getHeaderValues("X-XSS-Protection")).isEqualTo(Arrays.asList("1; mode=block"));
     }
 
     @Test
-    public void writeHeadersIncludeSubDomainsFalse() {
-        writer.setIncludeSubDomains(false);
+    public void writeHeadersNoBlock() {
+        writer.setBlock(false);
 
         writer.writeHeaders(request, response);
 
         assertThat(response.getHeaderNames().size()).isEqualTo(1);
-        assertThat(response.getHeader("Strict-Transport-Security")).isEqualTo("max-age=31536000");
+        assertThat(response.getHeaderValues("X-XSS-Protection")).isEqualTo(Arrays.asList("1"));
     }
 
     @Test
-    public void writeHeadersCustomMaxAgeInSeconds() {
-        writer.setMaxAgeInSeconds(1);
+    public void writeHeadersDisabled() {
+        writer.setBlock(false);
+        writer.setEnabled(false);
 
         writer.writeHeaders(request, response);
 
         assertThat(response.getHeaderNames().size()).isEqualTo(1);
-        assertThat(response.getHeader("Strict-Transport-Security")).isEqualTo("max-age=1 ; includeSubDomains");
+        assertThat(response.getHeaderValues("X-XSS-Protection")).isEqualTo(Arrays.asList("0"));
     }
 
     @Test
-    public void writeHeadersInsecureRequestDoesNotWriteHeader() {
-        request.setSecure(false);
+    public void setEnabledFalseWithBlockTrue() {
+        writer.setEnabled(false);
 
         writer.writeHeaders(request, response);
 
-        assertThat(response.getHeaderNames().isEmpty()).isTrue();
+        assertThat(response.getHeaderNames().size()).isEqualTo(1);
+        assertThat(response.getHeaderValues("X-XSS-Protection")).isEqualTo(Arrays.asList("0"));
     }
 
-    @Test(expected = IllegalArgumentException.class)
-    public void setMaxAgeInSecondsToNegative() {
-        writer.setMaxAgeInSeconds(-1);
-    }
 
-    @Test(expected = IllegalArgumentException.class)
-    public void setRequestMatcherToNull() {
-        writer.setRequestMatcher(null);
+    @Test(expected=IllegalArgumentException.class)
+    public void setBlockTrueWithEnabledFalse() {
+        writer.setBlock(false);
+        writer.setEnabled(false);
+
+        writer.setBlock(true);
     }
 }

web/src/test/java/org/springframework/security/web/header/writers/frameoptions/AbstractRequestParameterAllowFromStrategyTests.java

@@ -13,13 +13,14 @@
  * See the License for the specific language governing permissions and
  * limitations under the License.
  */
-package org.springframework.security.web.headers.frameoptions;
+package org.springframework.security.web.header.writers.frameoptions;
 
 import static org.fest.assertions.Assertions.assertThat;
 
 import org.junit.Before;
 import org.junit.Test;
 import org.springframework.mock.web.MockHttpServletRequest;
+import org.springframework.security.web.header.writers.frameoptions.AbstractRequestParameterAllowFromStrategy;
 
 /**
  * @author Rob Winch

web/src/test/java/org/springframework/security/web/header/writers/frameoptions/FrameOptionsHeaderWriterTests.java

@@ -13,7 +13,7 @@
  * See the License for the specific language governing permissions and
  * limitations under the License.
  */
-package org.springframework.security.web.headers.frameoptions;
+package org.springframework.security.web.header.writers.frameoptions;
 
 import static org.fest.assertions.Assertions.assertThat;
 import static org.mockito.Mockito.when;
@@ -27,7 +27,9 @@ import org.mockito.Mock;
 import org.mockito.runners.MockitoJUnitRunner;
 import org.springframework.mock.web.MockHttpServletRequest;
 import org.springframework.mock.web.MockHttpServletResponse;
-import org.springframework.security.web.headers.frameoptions.XFrameOptionsHeaderWriter.XFrameOptionsMode;
+import org.springframework.security.web.header.writers.frameoptions.AllowFromStrategy;
+import org.springframework.security.web.header.writers.frameoptions.XFrameOptionsHeaderWriter;
+import org.springframework.security.web.header.writers.frameoptions.XFrameOptionsHeaderWriter.XFrameOptionsMode;
 
 /**
  * @author Rob Winch

web/src/test/java/org/springframework/security/web/header/writers/frameoptions/RegExpAllowFromStrategyTests.java

@@ -1,4 +1,4 @@
-package org.springframework.security.web.headers.frameoptions;
+package org.springframework.security.web.header.writers.frameoptions;
 
 import static org.hamcrest.CoreMatchers.is;
 import static org.junit.Assert.assertThat;
@@ -7,6 +7,7 @@ import java.util.regex.PatternSyntaxException;
 
 import org.junit.Test;
 import org.springframework.mock.web.MockHttpServletRequest;
+import org.springframework.security.web.header.writers.frameoptions.RegExpAllowFromStrategy;
 
 /**
  *

web/src/test/java/org/springframework/security/web/header/writers/frameoptions/StaticAllowFromStrategyTests.java

@@ -1,7 +1,8 @@
-package org.springframework.security.web.headers.frameoptions;
+package org.springframework.security.web.header.writers.frameoptions;
 
 import org.junit.Test;
 import org.springframework.mock.web.MockHttpServletRequest;
+import org.springframework.security.web.header.writers.frameoptions.StaticAllowFromStrategy;
 
 import java.net.URI;
 

web/src/test/java/org/springframework/security/web/header/writers/frameoptions/WhiteListedAllowFromStrategyTests.java

@@ -1,7 +1,8 @@
-package org.springframework.security.web.headers.frameoptions;
+package org.springframework.security.web.header.writers.frameoptions;
 
 import org.junit.Test;
 import org.springframework.mock.web.MockHttpServletRequest;
+import org.springframework.security.web.header.writers.frameoptions.WhiteListedAllowFromStrategy;
 
 import java.util.ArrayList;
 import java.util.List;