Security HTTP response headers

The following sections discuss Spring Security's support for adding various security headers to the response.

Default security headers

Spring Security allows users to easily inject default security headers to assist in protecting their application. The following is a list of the current default security headers provided by Spring Security:

• Cache-Control
• Content-Type Options
• HTTP Strict Transport Security
• X-Frame-Options
• X-XSS-Protection

While each of these headers is considered best practice, it should be noted that not all clients utilize these headers, so additional testing is encouraged. For passivity reasons, if you are using Spring Security's XML namespace support, you must explicitly enable the security headers. All of the default headers can be easily added using the <headers> element with no child elements.

SEC-2348 is logged to ensure Spring Security 4.x's XML namespace configuration will enable Security headers by default (https://github.com/spring-projects...