Deprecate X-FRAME-OPTIONS ALLOW-FROM Directive

Closes gh-8677

web/src/main/java/org/springframework/security/web/header/writers/frameoptions/AbstractRequestParameterAllowFromStrategy.java

@@ -29,7 +29,12 @@ import javax.servlet.http.HttpServletRequest;
  *
  * @author Marten Deinum
  * @since 3.2
+ * @deprecated ALLOW-FROM is an obsolete directive that no longer works in modern browsers. Instead use
+ * Content-Security-Policy with the
+ * <a href="https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy/frame-ancestors">frame-ancestors</a>
+ * directive.
  */
+@Deprecated
 abstract class AbstractRequestParameterAllowFromStrategy implements AllowFromStrategy {
 
 	private static final String DEFAULT_ORIGIN_REQUEST_PARAMETER = "x-frames-allow-from";

web/src/main/java/org/springframework/security/web/header/writers/frameoptions/AllowFromStrategy.java

@@ -23,7 +23,12 @@ import javax.servlet.http.HttpServletRequest;
  *
  * @author Marten Deinum
  * @since 3.2
+ * @deprecated ALLOW-FROM is an obsolete directive that no longer works in modern browsers. Instead use
+ * Content-Security-Policy with the
+ * <a href="https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy/frame-ancestors">frame-ancestors</a>
+ * directive.
  */
+@Deprecated
 public interface AllowFromStrategy {
 
 	/**

web/src/main/java/org/springframework/security/web/header/writers/frameoptions/RegExpAllowFromStrategy.java

@@ -26,7 +26,12 @@ import java.util.regex.Pattern;
  *
  * @author Marten Deinum
  * @since 3.2
+ * @deprecated ALLOW-FROM is an obsolete directive that no longer works in modern browsers. Instead use
+ * Content-Security-Policy with the
+ * <a href="https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy/frame-ancestors">frame-ancestors</a>
+ * directive.
  */
+@Deprecated
 public final class RegExpAllowFromStrategy extends
 		AbstractRequestParameterAllowFromStrategy {
 

web/src/main/java/org/springframework/security/web/header/writers/frameoptions/StaticAllowFromStrategy.java

@@ -20,7 +20,13 @@ import java.net.URI;
 
 /**
  * Simple implementation of the {@code AllowFromStrategy}
+ *
+ * @deprecated ALLOW-FROM is an obsolete directive that no longer works in modern browsers. Instead use
+ * Content-Security-Policy with the
+ * <a href="https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy/frame-ancestors">frame-ancestors</a>
+ * directive.
  */
+@Deprecated
 public final class StaticAllowFromStrategy implements AllowFromStrategy {
 
 	private final URI uri;

web/src/main/java/org/springframework/security/web/header/writers/frameoptions/WhiteListedAllowFromStrategy.java

@@ -24,7 +24,12 @@ import org.springframework.util.Assert;
  *
  * @author Marten Deinum
  * @since 3.2
+ * @deprecated ALLOW-FROM is an obsolete directive that no longer works in modern browsers. Instead use
+ * Content-Security-Policy with the
+ * <a href="https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy/frame-ancestors">frame-ancestors</a>
+ * directive.
  */
+@Deprecated
 public final class WhiteListedAllowFromStrategy extends
 		AbstractRequestParameterAllowFromStrategy {
 

web/src/main/java/org/springframework/security/web/header/writers/frameoptions/XFrameOptionsHeaderWriter.java

@@ -68,7 +68,13 @@ public final class XFrameOptionsHeaderWriter implements HeaderWriter {
 	 *
 	 * @param allowFromStrategy the strategy for determining what the value for ALLOW_FROM
 	 * is.
+	 *
+	 * @deprecated ALLOW-FROM is an obsolete directive that no longer works in modern browsers. Instead use
+	 * Content-Security-Policy with the
+	 * <a href="https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy/frame-ancestors">frame-ancestors</a>
+	 * directive.
 	 */
+	@Deprecated
 	public XFrameOptionsHeaderWriter(AllowFromStrategy allowFromStrategy) {
 		Assert.notNull(allowFromStrategy, "allowFromStrategy cannot be null");
 		this.frameOptionsMode = XFrameOptionsMode.ALLOW_FROM;
@@ -107,7 +113,15 @@ public final class XFrameOptionsHeaderWriter implements HeaderWriter {
 	 * @since 3.2
 	 */
 	public enum XFrameOptionsMode {
-		DENY("DENY"), SAMEORIGIN("SAMEORIGIN"), ALLOW_FROM("ALLOW-FROM");
+		DENY("DENY"), SAMEORIGIN("SAMEORIGIN"),
+		/**
+		 * @deprecated ALLOW-FROM is an obsolete directive that no longer works in modern browsers. Instead use
+		 * Content-Security-Policy with the
+		 * <a href="https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy/frame-ancestors">frame-ancestors</a>
+		 * directive.
+		 */
+		@Deprecated
+		ALLOW_FROM("ALLOW-FROM");
 
 		private String mode;