Cwikius-Spring/spring-security
1
0
Fork 0
mirror of synced 2026-08-06 02:08:01 +00:00
Code Issues Packages Projects Releases Wiki Activity

SEC-2348: Security HTTP Response Headers enabled by default w/ XML

Browse Source
This commit is contained in:
Rob Winch
2014-11-21 16:06:29 -06:00
parent 2e1e9885ec
commit eedbf44235
14 changed files with 3444 additions and 27 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/manual/src/asciidoc/index.adoc
+7
View File
@@ -6645,8 +6645,15 @@ This element allows for configuring additional (security) headers to be send wit
** `X-XSS-Protection` - Can be set using the <<nsa-xss-protection,xss-protection>> element. The http://en.wikipedia.org/wiki/Cross-site_scripting[X-XSS-Protection ] header can be used by browser to do basic control.
** `X-Content-Type-Options` - Can be set using the <<nsa-content-type-options,content-type-options>> element. The http://blogs.msdn.com/b/ie/archive/2008/09/02/ie8-security-part-vi-beta-2-update.aspx[X-Content-Type-Options] header prevents Internet Explorer from MIME-sniffing a response away from the declared content-type. This also applies to Google Chrome, when downloading extensions.
[[nsa-headers-attributes]]
===== <headers> Attributes
The attributes on the `<headers>` element control the headers element.
[[nsa-headers-disabled]]
* **disabled**
Optional attribute that specifies to disable Spring Security's HTTP response headers. The default is false (the headers are enabled).
[[nsa-headers-parents]]
===== Parent Elements of <headers>