Spring 5.0 Cookbook

How it works...

Response headers must also be protected from exploitation by adding security headers or by filtering the default outgoing header information of the application. Preferably, applications must attain the following headers related to the caching browser history:

Cache-Control: no-cache, no-store, max-age=0, must-revalidate 
Pragma: no-cache 
Expires: 0  

HttpSecurity has headers().defaultsDisabled().cacheControl(), which disables caching information in the browser history.

To avoid content sniffing and illegal injection of scripts, HttpSecurity has the ability to disable content type options through the method headers().contentTypeOptions().disable(). The execution of this method results in a security header:

X-Content-Type-Options: ...