Spring Security - Third Edition

The HeadersWriter instance

When the namespace or Java configuration does not support the headers you want, you can create a custom HeadersWriter instance or even provide a custom implementation of HeadersWriter.

Let's take a look at an example of using a custom instance of XFrameOptionsHeaderWriter. Perhaps you want to allow the framing of content for the same origin. This is easily supported by setting the policy attribute to SAMEORIGIN, but let's take a look at a more explicit example using the ref attribute, as shown in the following code snippet:

@Overrideprotected void configure(HttpSecurity http) throws Exception {   http.headers()       .addHeaderWriter(           new XFrameOptionsHeaderWriter(               XFrameOptionsMode.SAMEORIGIN));}