XFrameOptionsHttpHeadersWriter.java

/*
 *
 *  * Copyright 2002-2017 the original author or authors.
 *  *
 *  * Licensed under the Apache License, Version 2.0 (the "License");
 *  * you may not use this file except in compliance with the License.
 *  * You may obtain a copy of the License at
 *  *
 *  *      http://www.apache.org/licenses/LICENSE-2.0
 *  *
 *  * Unless required by applicable law or agreed to in writing, software
 *  * distributed under the License is distributed on an "AS IS" BASIS,
 *  * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 *  * See the License for the specific language governing permissions and
 *  * limitations under the License.
 *
 */
package org.springframework.security.web.server.header;

import org.springframework.web.server.ServerWebExchange;

import reactor.core.publisher.Mono;

/**
 * @author Rob Winch
 * @since 5.0
 */
public class XFrameOptionsHttpHeadersWriter implements HttpHeadersWriter {
	public static final String X_FRAME_OPTIONS = "X-Frame-Options";

	private HttpHeadersWriter delegate = createDelegate(Mode.DENY);

	/*
	 * (non-Javadoc)
	 *
	 * @see org.springframework.security.web.server.HttpHeadersWriter#
	 * writeHttpHeaders(org.springframework.web.server.ServerWebExchange)
	 */
	@Override
	public Mono<Void> writeHttpHeaders(ServerWebExchange exchange) {
		return delegate.writeHttpHeaders(exchange);
	}

	/**
	 * Sets the X-Frame-Options mode. There is no support for ALLOW-FROM because
	 * not <a href=
	 * "https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-Frame-Options">all
	 * browsers support it</a>. Consider using X-Frame-Options with
	 * Content-Security-Policy <a href=
	 * "https://w3c.github.io/webappsec/specs/content-security-policy/#directive-frame-ancestors">frame-ancestors</a>.
	 *
	 * @param mode
	 */
	public void setMode(Mode mode) {
		this.delegate = createDelegate(mode);
	}

	/**
	 * The X-Frame-Options values. There is no support for ALLOW-FROM because
	 * not <a href=
	 * "https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-Frame-Options">all
	 * browsers support it</a>. Consider using X-Frame-Options with
	 * Content-Security-Policy <a href=
	 * "https://w3c.github.io/webappsec/specs/content-security-policy/#directive-frame-ancestors">frame-ancestors</a>.
	 *
	 * @author Rob Winch
	 * @since 5.0
	 */
	public enum Mode {
		/**
		 * A browser receiving content with this header field MUST NOT display
		 * this content in any frame.
		 */
		DENY,
		/**
		 * A browser receiving content with this header field MUST NOT display
		 * this content in any frame from a page of different origin than the
		 * content itself.
		 *
		 * If a browser or plugin cannot reliably determine whether or not the
		 * origin of the content and the frame are the same, this MUST be
		 * treated as "DENY".
		 */
		SAMEORIGIN;
	}

	private static HttpHeadersWriter createDelegate(Mode mode) {
		// @formatter:off
		return StaticHttpHeadersWriter.builder().header(X_FRAME_OPTIONS, mode.name()).build();
		// @formatter:on

	}
}