Spring Security Misconfiguration: Disabled Security Headers

Java/JSP

Abstract

Spring Security 預設安全性標頭已停用。

Explanation

Spring Security 會設定預設安全性標頭，以協助保護應用程式。Spring Security 插入的預設安全性標頭包括：


Cache-Control: no-cache, no-store, max-age=0, must-revalidate
Pragma: no-cache
Expires: 0
X-Content-Type-Options: nosniff
Strict-Transport-Security: max-age=31536000 ; includeSubDomains
X-Frame-Options: DENY
X-XSS-Protection: 1; mode=block

這些是合理的標頭，可協助保護應用程式。除非取代為限制更高的值，否則請勿停用這些標頭。

範例 1：以下程式碼會停用 Spring Security 預設標頭：


	<http auto-config="true">
        ...
        <headers disabled="true"/>
        ...
	</http>

References

[1] Standards Mapping - FIPS200 CM

[2] Standards Mapping - General Data Protection Regulation (GDPR) Indirect Access to Sensitive Data

[3] Standards Mapping - NIST Special Publication 800-53 Revision 4 CM-6 Configuration Settings (P1)

[4] Standards Mapping - NIST Special Publication 800-53 Revision 5 CM-6 Configuration Settings

[5] Standards Mapping - OWASP API 2023 API8 Security Misconfiguration

[6] Standards Mapping - OWASP Mobile 2014 M1 Weak Server Side Controls

[7] Standards Mapping - OWASP Top 10 2004 A10 Insecure Configuration Management

[8] Standards Mapping - OWASP Top 10 2010 A6 Security Misconfiguration

[9] Standards Mapping - OWASP Top 10 2013 A5 Security Misconfiguration

[10] Standards Mapping - OWASP Top 10 2017 A6 Security Misconfiguration

[11] Standards Mapping - OWASP Top 10 2021 A05 Security Misconfiguration

[12] Standards Mapping - Payment Card Industry Data Security Standard Version 1.1 Requirement 6.5.10

[13] Standards Mapping - Payment Card Industry Data Security Standard Version 4.0 Requirement 2.2.6

[14] Standards Mapping - Payment Card Industry Data Security Standard Version 4.0.1 Requirement 2.2.6

[15] Standards Mapping - Payment Card Industry Software Security Framework 1.2 Control Objective C.3.1 - Web Software Attack Mitigation

[16] Standards Mapping - Web Application Security Consortium Version 2.00 Server Misconfiguration (WASC-14)

desc.config.java.spring_security_misconfiguration_disabled_security_headers