Setting httpStrictTransportSecurity and contentSecurityPolicy答案

【问题标题】：Setting httpStrictTransportSecurity and contentSecurityPolicySetting httpStrictTransportSecurity and contentSecurityPolicy
【发布时间】：2022-12-02 04:14:41
【问题描述】：

In my Spring Boot application, I have a security config class for which I am trying to set response security headers i.e. httpStrictTransportSecurity and contentSecurityPolicy which is not getting in response. Any help would be highly appreciated.

@Override
protected void configure(HttpSecurity http) throws Exception {
    http
        .headers()
            .frameOptions().deny()
            .xssProtection()
                .and()
            .contentSecurityPolicy("default-src 'self'; script-src 'self' '=== key ==='")
                .and()
            .referrerPolicy(referrerPolicy -> referrerPolicy.policy(ReferrerPolicyHeaderWriter.ReferrerPolicy.STRICT_ORIGIN_WHEN_CROSS_ORIGIN))
            .httpStrictTransportSecurity()
                .includeSubDomains(true)
                .maxAgeInSeconds(31536000);

}

After setting contentSecurityPolicy and maxAgeInSeconds to 31536000 we are still getting strict-transport-security:max-age as 15724800 not able to see contentSecurityPolicy in the response.

【问题讨论】：

31536000 is Spring Security's default, so it should not neccessary to change it. If you get 15724800 there must be another configuration with this value. Do you have more than one security configuration? Or is your application running behind a proxy, which changes the HTTP response header?

标签： spring spring-boot spring-security content-security-policy

【解决方案1】：

For httpStrictTransportSecurity header to be active you need to set the requestMatcher for the this header.

 .httpStrictTransportSecurity()
 .requestMatcher(AnyRequestMatcher.INSTANCE)

Hence your configuration should look like this.

@Override
protected void configure(HttpSecurity http) throws Exception {
    http
        .headers()
            .frameOptions().deny()
            .xssProtection()
                .and()
            .contentSecurityPolicy("default-src 'self'; script-src 'self' '=== key ==='")
                .and()
            .referrerPolicy(referrerPolicy -> referrerPolicy.policy(ReferrerPolicyHeaderWriter.ReferrerPolicy.STRICT_ORIGIN_WHEN_CROSS_ORIGIN))
            .httpStrictTransportSecurity()
            .requestMatcher(AnyRequestMatcher.INSTANCE)
;

}

【讨论】：