Package org.springframework.security.config.annotation.web.configurers

Class HeadersConfigurer.XXssConfig

java.lang.Object

org.springframework.security.config.annotation.web.configurers.HeadersConfigurer.XXssConfig

Enclosing class:

HeadersConfigurer<H extends HttpSecurityBuilder<H>>

public final class HeadersConfigurer.XXssConfig
extends Object

Method Summary

Modifier and Type	Method	Description
HeadersConfigurer<H>	and()	Deprecated, for removal: This API element is subject to removal in a future version. For removal in 7.0.
HeadersConfigurer<H>	disable()	Disables X-XSS-Protection header (does not include it)
HeadersConfigurer<H>.XXssConfig	headerValue(XXssProtectionHeaderWriter.HeaderValue headerValue)	Sets the value of the X-XSS-PROTECTION header.

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Method Details

headerValue

public HeadersConfigurer<H>.XXssConfig headerValue(XXssProtectionHeaderWriter.HeaderValue headerValue)

Sets the value of the X-XSS-PROTECTION header. OWASP recommends using XXssProtectionHeaderWriter.HeaderValue.DISABLED. If XXssProtectionHeaderWriter.HeaderValue.DISABLED, will specify that X-XSS-Protection is disabled. For example:

 X-XSS-Protection: 0
 

If XXssProtectionHeaderWriter.HeaderValue.ENABLED, will contain a value of 1, but will not specify the mode as blocked. In this instance, any content will be attempted to be fixed. For example:

 X-XSS-Protection: 1
 

If XXssProtectionHeaderWriter.HeaderValue.ENABLED_MODE_BLOCK, will contain a value of 1 and will specify mode as blocked. The content will be replaced with "#". For example:

 X-XSS-Protection: 1; mode=block
 

Parameters:

headerValue - the new header value

Since:

5.8

disable

public HeadersConfigurer<H> disable()

Disables X-XSS-Protection header (does not include it)

Returns:

the HeadersConfigurer for additional configuration

and

@Deprecated(since="6.1",
            forRemoval=true)
public HeadersConfigurer<H> and()

Deprecated, for removal: This API element is subject to removal in a future version.

For removal in 7.0. Use HeadersConfigurer.xssProtection(Customizer) or xssProtection(Customizer.withDefaults()) to stick with defaults. See the documentation for more details.

Allows completing configuration of X-XSS-Protection and continuing configuration of headers.

Returns:

the HeadersConfigurer for additional configuration