Spring Security - Third Edition

Static headers

There may be times you wish to inject custom security headers into your application that are not supported out of the box. For example, perhaps you wish to have early support for a content security policy in order to ensure that resources are only loaded from the same origin. Since support for a content security policy has not been finalized, browsers use one of two common extension headers to implement the feature. This means we will need to inject the policy twice. An example of the headers can be seen in the following code snippet:

X-Content-Security-Policy: default-src 'self'X-WebKit-CSP: default-src 'self'

When using Java configuration, these headers can be added to the response using the header() method, as follows: