Security-Header-Architektur für Spring Boot

// src/main/java/com/example/config/SecurityConfig.java
package com.example.config;

import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.web.SecurityFilterChain;
import org.springframework.security.web.header.writers.*;

@Configuration
public class SecurityConfig {

    @Bean
    public SecurityFilterChain securityFilterChain(HttpSecurity http)
            throws Exception {

        http.headers(headers -> headers
            // --- CSP (nicht als Default gesetzt) ---
            .contentSecurityPolicy(csp -> csp
                .policyDirectives("default-src 'self'; script-src 'self'; "
                    + "style-src 'self' 'unsafe-inline'; "
                    + "img-src 'self' data: https:; "
                    + "font-src 'self'; object-src 'none'; "
                    + "frame-ancestors 'self'; base-uri 'self'; "
                    + "form-action 'self'"))

            // --- HSTS (nicht als Default gesetzt) ---
            .httpStrictTransportSecurity(hsts -> hsts
                .includeSubDomains(true)
                .maxAgeInSeconds(31536000)
                .preload(true))

            // --- Referrer-Policy (nicht als Default) ---
            .referrerPolicy(referrer -> referrer
                .policy(ReferrerPolicyHeaderWriter.ReferrerPolicy
                    .STRICT_ORIGIN_WHEN_CROSS_ORIGIN))

            // --- Permissions-Policy (nicht als Default) ---
            .permissionsPolicy(pp -> pp
                .policy("camera=(), microphone=(), geolocation=(), payment=()"))

            // --- X-Frame-Options: Default ist DENY ---
            // Auf SAMEORIGIN ändern wenn iframes noetig:
            .frameOptions(fo -> fo.sameOrigin())

            // --- X-Content-Type-Options: Default nosniff ---
            // --- Cache-Control: Default no-cache ---
            // --- X-XSS-Protection: Default 0 ---
            // Diese drei werden automatisch gesetzt
        );

        return http.build();
    }
}

# Spring Boot Anwendung starten
./mvnw spring-boot:run
# oder mit Gradle
./gradlew bootRun

# Security Headers prüfen
curl -sI http://localhost:8080 | grep -iE "content-security|strict-transport|x-frame|referrer|x-content-type|permissions-policy"

# Erwartete Ausgabe:
cache-control: no-cache, no-store, max-age=0, must-revalidate
x-content-type-options: nosniff
x-frame-options: SAMEORIGIN
content-security-policy: default-src 'self'; script-src 'self'; ...
strict-transport-security: max-age=31536000; includeSubDomains; preload
referrer-policy: strict-origin-when-cross-origin
permissions-policy: camera=(), microphone=(), geolocation=(), payment=()