Package org.springframework.security.config.annotation.web.configurers

Class HeadersConfigurer<H extends HttpSecurityBuilder<H>>

  • All Implemented Interfaces:
    SecurityConfigurer<DefaultSecurityFilterChain,​H>
    public class HeadersConfigurer<H extends HttpSecurityBuilder<H>>
extends AbstractHttpConfigurer<HeadersConfigurer<H>,​H>

    Adds the Security HTTP headers to the response. Security HTTP headers is activated by default when using EnableWebSecurity's default constructor.

    The default headers include are: 

     Cache-Control: no-cache, no-store, max-age=0, must-revalidate
 Pragma: no-cache
 Expires: 0
 X-Content-Type-Options: nosniff
 Strict-Transport-Security: max-age=31536000 ; includeSubDomains
 X-Frame-Options: DENY
 X-XSS-Protection: 1; mode=block
    Since:
    3.2