如何在Spring中添加HTTP“Feature-Policy”标头

Question

我需要添加HTTP“功能 - 策略”响应标头，但我没有找到任何方式在春季头文件中实现这一点 -

@EnableWebSecurity
public class WebSecurityConfig extends WebSecurityConfigurerAdapter {

    @Override
    protected void configure(HttpSecurity http) throws Exception {
        http
        // ...
        .headers()
            .contentSecurityPolicy("script-src 'self' https://trustedscripts.example.com; object-src https://trustedplugins.example.com; report-uri /csp-report-endpoint/");
    }

我可以看到规范草案here，但在Spring中使用它并不多。任何建议将不胜感激。

Answer 1

要创建自定义标题，您应该使用addHeaderWriter并添加StaticHeadersWriter

例：

@EnableWebSecurity
@Configuration
public class WebSecurityConfig extends WebSecurityConfigurerAdapter {

    @Override
    protected void configure(HttpSecurity http) throws Exception {
        http
        // ...
        .headers()
            .contentSecurityPolicy("script-src 'self' https://trustedscripts.example.com; object-src https://trustedplugins.example.com; report-uri /csp-report-endpoint/")
            .and()
            .addHeaderWriter(new StaticHeadersWriter("Feature-Policy", "vibrate 'none'; usermedia 'none'"));
    }
}