安全 HTTP 响应头

您可以使用安全 HTTP 响应头来提高 Web 应用程序的安全性。本节专门介绍基于 WebFlux 的安全 HTTP 响应头支持。

默认安全头

Spring Security 提供了一组默认的安全 HTTP 响应头以提供安全的默认值。尽管这些头都被认为是最佳实践，但应注意并非所有客户端都使用这些头，因此鼓励进行额外的测试。

您可以自定义特定的头。例如，假设您想要默认值，但希望为 X-Frame-Options 指定 SAMEORIGIN。

您可以通过以下配置实现：

自定义默认安全头

Java
Kotlin

@Bean
SecurityWebFilterChain springSecurityFilterChain(ServerHttpSecurity http) {
	http
		// ...
		.headers((headers) -> headers
			.frameOptions((frameOptions) -> frameOptions
				.mode(Mode.SAMEORIGIN)
			)
		);
	return http.build();
}

@Bean
fun webFilterChain(http: ServerHttpSecurity): SecurityWebFilterChain {
    return http {
        // ...
        headers {
            frameOptions {
                mode = Mode.SAMEORIGIN
            }
        }
    }
}

如果您不希望添加默认值，并希望对使用什么具有显式控制，则可以禁用默认值。

禁用 HTTP 安全响应头

Java
Kotlin

@Bean
SecurityWebFilterChain springSecurityFilterChain(ServerHttpSecurity http) {
	http
		// ...
		.headers((headers) -> headers.disable());
	return http.build();
}

@Bean
fun webFilterChain(http: ServerHttpSecurity): SecurityWebFilterChain {
    return http {
        // ...
        headers {
            disable()
        }
    }
}

缓存控制

Spring Security 默认包含缓存控制头。

但是，如果您确实想缓存特定响应，您的应用程序可以选择性地将其添加到 ServerHttpResponse 以覆盖 Spring Security 设置的头。这对于确保 CSS、JavaScript 和图像等内容得到正确缓存非常有用。

使用 Spring WebFlux 时，您通常在配置中执行此操作。您可以在 Spring 参考文档的静态资源部分找到如何执行此操作的详细信息。

如有必要，您还可以禁用 Spring Security 的缓存控制 HTTP 响应头。

缓存控制已禁用

Java
Kotlin

@Bean
SecurityWebFilterChain springSecurityFilterChain(ServerHttpSecurity http) {
	http
		// ...
		.headers((headers) -> headers
			.cache((cache) -> cache.disable())
		);
	return http.build();
}

@Bean
fun webFilterChain(http: ServerHttpSecurity): SecurityWebFilterChain {
    return http {
        // ...
        headers {
            cache {
                disable()
            }
        }
    }
}

内容类型选项

默认情况下，Spring Security 包含 Content-Type 头。但是，您可以禁用它。

内容类型选项已禁用

Java
Kotlin

@Bean
SecurityWebFilterChain springSecurityFilterChain(ServerHttpSecurity http) {
	http
		// ...
		.headers((headers) -> headers
			.contentTypeOptions((contentTypeOptions) -> contentTypeOptions.disable())
		);
	return http.build();
}

@Bean
fun webFilterChain(http: ServerHttpSecurity): SecurityWebFilterChain {
    return http {
        // ...
        headers {
            contentTypeOptions {
                disable()
            }
        }
    }
}

HTTP 严格传输安全 (HSTS)

默认情况下，Spring Security 提供严格传输安全头。但是，您可以显式自定义结果。例如，以下示例显式提供了 HSTS。

严格传输安全

Java
Kotlin

@Bean
SecurityWebFilterChain springSecurityFilterChain(ServerHttpSecurity http) {
	http
		// ...
		.headers((headers) -> headers
			.hsts((hsts) -> hsts
				.includeSubdomains(true)
				.preload(true)
				.maxAge(Duration.ofDays(365))
			)
		);
	return http.build();
}

@Bean
fun webFilterChain(http: ServerHttpSecurity): SecurityWebFilterChain {
    return http {
        // ...
        headers {
            hsts {
                includeSubdomains = true
                preload = true
                maxAge = Duration.ofDays(365)
            }
        }
    }
}

X-Frame-Options

默认情况下，Spring Security 通过使用 X-Frame-Options 禁用在 iframe 中渲染。

您可以自定义框架选项以使用相同来源。

X-Frame-Options: SAMEORIGIN

Java
Kotlin

@Bean
SecurityWebFilterChain springSecurityFilterChain(ServerHttpSecurity http) {
	http
		// ...
		.headers((headers) -> headers
			.frameOptions((frameOptions) -> frameOptions
				.mode(SAMEORIGIN)
			)
		);
	return http.build();
}

@Bean
fun webFilterChain(http: ServerHttpSecurity): SecurityWebFilterChain {
    return http {
        // ...
        headers {
            frameOptions {
                mode = SAMEORIGIN
            }
        }
    }
}

X-XSS-Protection

默认情况下，Spring Security 通过使用 <> 指示浏览器禁用 XSS 审计器。您可以完全禁用 X-XSS-Protection 头。

X-XSS-Protection 自定义

Java
Kotlin

@Bean
SecurityWebFilterChain springSecurityFilterChain(ServerHttpSecurity http) {
	http
		// ...
		.headers((headers) -> headers
			.xssProtection((xssProtection) -> xssProtection.disable())
		);
	return http.build();
}

@Bean
fun webFilterChain(http: ServerHttpSecurity): SecurityWebFilterChain {
    return http {
        // ...
        headers {
            xssProtection {
                disable()
            }
        }
    }
}

您还可以更改头的值。

X-XSS-Protection 显式头值

Java
Kotlin

@Bean
SecurityWebFilterChain springSecurityFilterChain(ServerHttpSecurity http) {
	http
		// ...
		.headers((headers) -> headers
			.xssProtection((xssProtection) -> xssProtection.headerValue(XXssProtectionServerHttpHeadersWriter.HeaderValue.ENABLED_MODE_BLOCK))
		);
	return http.build();
}

@Bean
fun webFilterChain(http: ServerHttpSecurity): SecurityWebFilterChain {
    return http {
        // ...
        headers {
            xssProtection {
                headerValue = XXssProtectionServerHttpHeadersWriter.HeaderValue.ENABLED_MODE_BLOCK
            }
        }
    }
}

内容安全策略 (CSP)

默认情况下，Spring Security 不添加内容安全策略，因为在没有应用程序上下文的情况下无法知道合理的默认值。Web 应用程序作者必须声明要对受保护资源强制执行和/或监视的安全策略。

例如，考虑以下安全策略：

内容安全策略示例

Content-Security-Policy: script-src 'self' https://trustedscripts.example.com; object-src https://trustedplugins.example.com; report-uri /csp-report-endpoint/

给定上述策略，您可以启用 CSP 头。

内容安全策略

Java
Kotlin

@Bean
SecurityWebFilterChain springSecurityFilterChain(ServerHttpSecurity http) {
	http
		// ...
		.headers((headers) -> headers
			.contentSecurityPolicy((policy) -> policy
				.policyDirectives("script-src 'self' https://trustedscripts.example.com; object-src https://trustedplugins.example.com; report-uri /csp-report-endpoint/")
			)
		);
	return http.build();
}

@Bean
fun webFilterChain(http: ServerHttpSecurity): SecurityWebFilterChain {
    return http {
        // ...
        headers {
            contentSecurityPolicy {
                policyDirectives = "script-src 'self' https://trustedscripts.example.com; object-src https://trustedplugins.example.com; report-uri /csp-report-endpoint/"
            }
        }
    }
}

要启用 CSP report-only 头，请提供以下配置：

仅内容安全策略报告

Java
Kotlin

@Bean
SecurityWebFilterChain springSecurityFilterChain(ServerHttpSecurity http) {
	http
		// ...
		.headers((headers) -> headers
			.contentSecurityPolicy((policy) -> policy
				.policyDirectives("script-src 'self' https://trustedscripts.example.com; object-src https://trustedplugins.example.com; report-uri /csp-report-endpoint/")
				.reportOnly()
			)
		);
	return http.build();
}

@Bean
fun webFilterChain(http: ServerHttpSecurity): SecurityWebFilterChain {
    return http {
        // ...
        headers {
            contentSecurityPolicy {
                policyDirectives = "script-src 'self' https://trustedscripts.example.com; object-src https://trustedplugins.example.com; report-uri /csp-report-endpoint/"
                reportOnly = true
            }
        }
    }
}

Referrer Policy

Spring Security 默认添加 Referrer Policy 头，其指令为 no-referrer。您可以使用如下所示的配置更改 Referrer Policy 头：

Referrer Policy 配置

Java
Kotlin

@Bean
SecurityWebFilterChain springSecurityFilterChain(ServerHttpSecurity http) {
	http
		// ...
		.headers((headers) -> headers
			.referrerPolicy((referrer) -> referrer
				.policy(ReferrerPolicy.SAME_ORIGIN)
			)
		);
	return http.build();
}

@Bean
fun webFilterChain(http: ServerHttpSecurity): SecurityWebFilterChain {
    return http {
        // ...
        headers {
            referrerPolicy {
                policy = ReferrerPolicy.SAME_ORIGIN
            }
        }
    }
}

Feature Policy

默认情况下，Spring Security 不添加 Feature Policy 头。考虑以下 Feature-Policy 头：

Feature-Policy 示例

Feature-Policy: geolocation 'self'

您可以启用上述 Feature Policy 头。

Feature-Policy 配置

Java
Kotlin

@Bean
SecurityWebFilterChain springSecurityFilterChain(ServerHttpSecurity http) {
	http
		// ...
		.headers((headers) -> headers
			.featurePolicy("geolocation 'self'")
		);
	return http.build();
}

@Bean
fun webFilterChain(http: ServerHttpSecurity): SecurityWebFilterChain {
    return http {
        // ...
        headers {
            featurePolicy("geolocation 'self'")
        }
    }
}

Permissions Policy

默认情况下，Spring Security 不添加 Permissions Policy 头。考虑以下 Permissions-Policy 头：

Permissions-Policy 示例

Permissions-Policy: geolocation=(self)

您可以启用上述 Permissions Policy 头。

Permissions-Policy 配置

Java
Kotlin

@Bean
SecurityWebFilterChain springSecurityFilterChain(ServerHttpSecurity http) {
	http
		// ...
		.headers((headers) -> headers
			.permissionsPolicy((permissions) -> permissions
				.policy("geolocation=(self)")
			)
		);
	return http.build();
}

@Bean
fun webFilterChain(http: ServerHttpSecurity): SecurityWebFilterChain {
    return http {
        // ...
        headers {
            permissionsPolicy {
                policy = "geolocation=(self)"
            }
        }
    }
}

Clear Site Data

默认情况下，Spring Security 不添加 Clear-Site-Data 头。考虑以下 Clear-Site-Data 头：

Clear-Site-Data 示例

Clear-Site-Data: "cache", "cookies"

您可以在注销时发送 Clear-Site-Data 头。

Clear-Site-Data 配置

Java
Kotlin

@Bean
SecurityWebFilterChain springSecurityFilterChain(ServerHttpSecurity http) {
	ServerLogoutHandler securityContext = new SecurityContextServerLogoutHandler();
	ClearSiteDataServerHttpHeadersWriter writer = new ClearSiteDataServerHttpHeadersWriter(CACHE, COOKIES);
	ServerLogoutHandler clearSiteData = new HeaderWriterServerLogoutHandler(writer);
	DelegatingServerLogoutHandler logoutHandler = new DelegatingServerLogoutHandler(securityContext, clearSiteData);

	http
		// ...
		.logout()
			.logoutHandler(logoutHandler);
	return http.build();
}

@Bean
fun webFilterChain(http: ServerHttpSecurity): SecurityWebFilterChain {
    val securityContext: ServerLogoutHandler = SecurityContextServerLogoutHandler()
    val writer = ClearSiteDataServerHttpHeadersWriter(CACHE, COOKIES)
    val clearSiteData: ServerLogoutHandler = HeaderWriterServerLogoutHandler(writer)
    val customLogoutHandler = DelegatingServerLogoutHandler(securityContext, clearSiteData)

    return http {
        // ...
        logout {
            logoutHandler = customLogoutHandler
        }
    }
}