Package org.springframework.security.config.web.server

Class ServerHttpSecurity.HeaderSpec.HstsSpec

java.lang.Object

org.springframework.security.config.web.server.ServerHttpSecurity.HeaderSpec.HstsSpec

Enclosing class:

ServerHttpSecurity.HeaderSpec

public final class ServerHttpSecurity.HeaderSpec.HstsSpec
extends Object

Configures Strict Transport Security response header

See Also:

• ServerHttpSecurity.HeaderSpec.hsts()

Method Summary

Modifier and Type	Method	Description
ServerHttpSecurity.HeaderSpec	and()	Deprecated, for removal: This API element is subject to removal in a future version. For removal in 7.0.
ServerHttpSecurity.HeaderSpec	disable()	Disables strict transport security response header
ServerHttpSecurity.HeaderSpec.HstsSpec	includeSubdomains(boolean includeSubDomains)	Configures if subdomains should be included.
ServerHttpSecurity.HeaderSpec.HstsSpec	maxAge(Duration maxAge)	Configures the max age.
ServerHttpSecurity.HeaderSpec.HstsSpec	preload(boolean preload)	Configures if preload should be included.

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Method Details

maxAge

public ServerHttpSecurity.HeaderSpec.HstsSpec maxAge(Duration maxAge)

Configures the max age. Default is one year.

Parameters:

maxAge - the max age

Returns:

the ServerHttpSecurity.HeaderSpec.HstsSpec to continue configuring

includeSubdomains

public ServerHttpSecurity.HeaderSpec.HstsSpec includeSubdomains(boolean includeSubDomains)

Configures if subdomains should be included. Default is true

Parameters:

includeSubDomains - if subdomains should be included

Returns:

the ServerHttpSecurity.HeaderSpec.HstsSpec to continue configuring

preload

public ServerHttpSecurity.HeaderSpec.HstsSpec preload(boolean preload)

Configures if preload should be included. Default is false

See Website hstspreload.org for additional details.

Parameters:

preload - if subdomains should be included

Returns:

the ServerHttpSecurity.HeaderSpec.HstsSpec to continue configuring

Since:

5.2.0

and

@Deprecated(since="6.1",
            forRemoval=true)
public ServerHttpSecurity.HeaderSpec and()

Deprecated, for removal: This API element is subject to removal in a future version.

For removal in 7.0. Use ServerHttpSecurity.HeaderSpec.hsts(Customizer) or hsts(Customizer.withDefaults()) to stick with defaults. See the documentation for more details.

Allows method chaining to continue configuring the ServerHttpSecurity

Returns:

the ServerHttpSecurity.HeaderSpec to continue configuring

disable

public ServerHttpSecurity.HeaderSpec disable()

Disables strict transport security response header

Returns:

the ServerHttpSecurity.HeaderSpec to continue configuring