Reference of HTTP Header properties

spring.security.csp

policy

String

Content Security Policy.

This setting secures communication between web server and browser against various attacks like XSS, or injections.

See: Content Security Policy (CSP) - HTTP | MDN

spring.security.cors

allowed-origins

String

CORS Header: Access-Control-Allowed-Origin.

The Browser accepts resources from the allowed origin only. In the default, it will be created from:

${server.ssl.enabled:false} → if true, HTTPS

${server.address}

${server.port}

May be directly overwritten with

spring.security.cors.allowed-origins:

Allowed values are:

• * ( Asterisk - from everywhere)

• <origin> (one absolute URL)

Example:

spring.security.cors

allowed-headers

List<String>

CORS Header: Access-Control-Allowed-Headers.

The Headers, that are allowed by the browser. See:

Access-Control-Allow-Headers - HTTP | MDN

Allowed values are:

• *(Asterisk - all Headers)

• List<String> (String list, comma seperated)

Example:

spring.security.cors

allowed-headers

List<String>

CORS Header: Access-Control-Allowed-Headers.

The Headers, that are allowed by the browser. See:

Access-Control-Allow-Headers - HTTP | MDN

Allowed values are:

• *(Asterisk - all Headers)

• List<String> (String list, comma seperated)

Example:

spring.security.cors

allow-credentials

true

Boolean

CORS Header: Access-Control-Allow-Credentials.

Tell the browser, whether it allowes cross-origin request credentials or not (credentials may be in cookies etc.)

See: Access-Control-Allow-Credentials - HTTP | MDN

Example:

spring.security.cors

allow-x-frame-options-from

DENY

String (Enum)

CORS Header: X-Frame-Options.

Tells the browser if it accept the content of the viewer when its embedded in an iFrame.

See: X-Frame-Options - HTTP | MDN

Allowed values are:

• * (Allow from everywhere)

• DENY

• SAMEORIGIN

• ALLOW-FROM XXXXXX (http-address [origin])

Example:

spring.security.xss

mode

disabled

String (Enum)

Cross-Site Protection Header.

See: X-XSS-Protection - HTTP | MDN

Allowed values are:

• block mode

• block

• disabled

Example: