How to Add Spring Security HTTP Response Headers

Question

Starting with Spring 3.2 I can simply add this to my security xml:

 <security:headers>
    <security:frame-options
            policy="SAMEORIGIN" />
</security:headers>

But this is not supported in Spring version 3.1, any workaround for this without having to upgrade the version?

This is documentation for version 3.1:

http://docs.spring.io/spring-security/site/docs/3.1.3.RELEASE/reference/springsecurity.html

You can set custom header in Controller response.setHeader("X-Frame-Options", "SAMEORIGIN"); — Vazgen Torosyan
– Vazgen Torosyan, Commented Aug 22, 2017 at 12:07

chimmi · Accepted Answer · 2017-08-22 18:22:47Z

3

I believe XFrameOptionsHeaderWriter implements logic behind this configuration. It was introduced in Spring 3.2, nothing similar exist prior to that version.

If you want to implement this yourself, you can use a simple filter:

public class XFrameOptionsHeaderFilter extends OncePerRequestFilter {

    @Override
    protected void doFilterInternal(HttpServletRequest request, HttpServletResponse response, FilterChain filterChain) throws ServletException, IOException {
        response.setHeader("X-Frame-Options", "SAMEORIGIN");
        filterChain.doFilter(request, response);
    }

}

You need to create a bean for this class in your application context:

<bean id="xFrameOptionsHeaderFilter" class="your.package.XFrameOptionsHeaderFilter"/>

And then register the filter in your web.xml:

<filter>  
    <filter-name>xFrameOptionsHeaderFilter</filter-name>
    <filter-class>org.springframework.web.filter.DelegatingFilterProxy</filter-class>
</filter>
<filter-mapping>
    <filter-name>xFrameOptionsHeaderFilter</filter-name>
    <url-pattern>/*</url-pattern>
</filter-mapping>

edited Aug 22, 2017 at 18:22

answered Aug 22, 2017 at 12:33

chimmi

2,09516 silver badges30 bronze badges

Sign up to request clarification or add additional context in comments.

2 Comments

Spring Over a year ago

tnx very nice answer but I cant seem to get it working, I see the bean is loaded but method is not called when I make a request. any ideas what might be missing?

chimmi Over a year ago

Maybe you declared the bean in the wrong place? You should put it in your app-context, the one that is used in contextConfigLocation, not your servlet context.

Collectives™ on Stack Overflow

How to Add Spring Security HTTP Response Headers

1 Answer 1

2 Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

2 Comments

Your Answer

Sign up or log in

Post as a guest

Related