包括 Spring Security Headers，仍然收到“Header Not Set”漏洞警告答案

【问题标题】：Spring Security Headers included, still getting 'Header Not Set' vulnerability warning包括 Spring Security Headers，仍然收到“Header Not Set”漏洞警告
【发布时间】：2020-09-06 09:39:45
【问题描述】：

我想摆脱与 Header 相关的漏洞警告。（缺少 X-Frame 标头，缺少内容类型标头）

我浏览了 Spring 文档并进行了必要的更改。但仍然收到这些警告（我正在使用 Owasap Zap 安全工具来验证漏洞警告）

安全性.xml

<?xml version="1.0" encoding="UTF-8"?>
<beans xmlns="http://www.springframework.org/schema/beans"
       xmlns:security="http://www.springframework.org/schema/security"
       xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
       xsi:schemaLocation="http://www.springframework.org/schema/beans
        http://www.springframework.org/schema/beans/spring-beans-4.0.xsd
        http://www.springframework.org/schema/security
        http://www.springframework.org/schema/security/spring-security.xsd">

    <security:http create-session="never"  entry-point-ref="http403EntryPoint" >
    
        <security:headers>
            <security:content-type-options/>
            <security:frame-options/>    
        </security:headers>

    </security:http>

    <security:authentication-manager>
        <security:authentication-provider>
            <security:user-service>
                <security:user name="_" password="_" authorities="_" />
            </security:user-service>
        </security:authentication-provider>
    </security:authentication-manager>

    <bean id="http403EntryPoint" class="org.springframework.security.web.authentication.Http403ForbiddenEntryPoint">
    </bean>

</beans>

我已经在 pom 文件中添加了所需的依赖项。

<dependency>
   <groupId>org.springframework.security</groupId>
   <artifactId>spring-security-web</artifactId>
   <version 4.1.0.RELEASE</version>
</dependency>

<dependency>
   <groupId>org.springframework.security</groupId>
   <artifactId>spring-security-config</artifactId>
   <version 4.1.0.RELEASE</version>
</dependency>

【问题讨论】：

标签： spring spring-mvc spring-security http-headers

【解决方案1】：

我在 web.xml 中缺少所需的 servlet 过滤器

<filter>
    <filter-name>springSecurityFilterChain</filter-name>
    <filter-class>org.springframework.web.filter.DelegatingFilterProxy</filter-class>
    <async-supported>true</async-supported>
</filter>
<filter-mapping>
    <filter-name>springSecurityFilterChain</filter-name>
    <url-pattern>/*</url-pattern>
    <dispatcher>REQUEST</dispatcher>
</filter-mapping>

此过滤器调用 Spring bean (springSecurityFilterChain)，它是由命名空间创建的内部基础结构 bean，用于处理 Web 安全。

【讨论】：