Cwikius-Spring/spring-security
1
0
Fork 0
mirror of synced 2026-08-05 17:57:15 +00:00
Code Issues Packages Projects Releases Wiki Activity

SEC-2230: HTTP Strict Transport Security (HSTS)Add support for Strict

Browse Source 
This is a distinct filter as apposed to reusing StaticHeaderWriter
since the specification specifies that the "Strict-Transport-Security"
header should only be set on secure requests. It would not make sense to
require DelegatingRequestMatcherHeaderWriter since this requirement is
in the specification.
This commit is contained in:
Rob Winch
2013-07-29 18:22:28 -05:00
parent 8013cd54d6
commit c85328c5d1
7 changed files with 416 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/manual/src/docbook/appendix-namespace.xml
+36
View File
@@ -267,6 +267,9 @@
<listitem><literal>Cache-Control</literal> and <literal>Pragma</literal> - Can be set using the
<link xlink:href="#nsa-cache-control">cache-control</link> element. This ensures that the
browser does not cache your secured pages.</listitem>
<listitem><literal>Strict-Transport-Security</literal> - Can be set using the
<link xlink:href="#nsa-hsts">hsts</link> element. This ensures that the
browser automatically requests HTTPS for future requests.</listitem>
<listitem><literal>X-Frame-Options</literal> - Can be set using the
<link xlink:href="#nsa-frame-options">frame-options</link> element. The
<link xlink:href="http://en.wikipedia.org/wiki/Clickjacking#X-Frame-Options">X-Frame-Options
@@ -295,6 +298,7 @@
<listitem><link xlink:href="#nsa-content-type-options">content-type-options</link></listitem>
<listitem><link xlink:href="#nsa-frame-options">frame-options</link></listitem>
<listitem><link xlink:href="#nsa-header">header</link></listitem>
<listitem><link xlink:href="#nsa-hsts">hsts</link></listitem>
<listitem><link xlink:href="#nsa-xss-protection">xss-protection</link></listitem>
</itemizedlist>
</section>
@@ -310,6 +314,38 @@
</itemizedlist>
</section>
</section>
<section xml:id="nsa-hsts">
<title><literal>&lt;hsts&gt;</literal></title>
<para>When enabled adds the <link xlink:href="http://tools.ietf.org/html/rfc6797">Strict-Transport-Security</link> header to the response
for any secure request. This allows the server to instruct browsers to automatically use HTTPS for future requests.</para>
<section xml:id="nsa-hsts-attributes">
<title><literal>&lt;hsts&gt;</literal> Attributes</title>
<section xml:id="nsa-hsts-include-subdomains">
<title><literal>include-sub-domains</literal></title>
<para>
Specifies if subdomains should be included. Default true.
</para>
</section>
<section xml:id="nsa-hsts-max-age-seconds">
<title><literal>max-age-seconds</literal></title>
<para>
Specifies the maximum ammount of time the host should be considered a Known HSTS Host. Default one year.
</para>
</section>
<section xml:id="nsa-hsts-request-matcher-ref">
<title><literal>request-matcher-ref</literal></title>
<para>
The RequestMatcher instance to be used to determine if the header should be set. Default is if HttpServletRequest.isSecure() is true.
</para>
</section>
</section>
<section xml:id="nsa-hsts-parents">
<title>Parent Elements of <literal>&lt;hsts&gt;</literal></title>
<itemizedlist>
<listitem><link xlink:href="#nsa-headers">headers</link></listitem>
</itemizedlist>
</section>
</section>
<section xml:id="nsa-frame-options">
<title><literal>&lt;frame-options&gt;</literal></title>
<para>When enabled adds the <link xlink:href="http://tools.ietf.org/html/draft-ietf-websec-x-frame-options-01">X-Frame-Options header</link> to the response, this allows newer browsers to do some security