Security headers: Simplify setting of headers, possibly via plugin

While working on an application, I left one of my not favourite todo’s unchecked: Taking care of setting secure headers.

There is a OWASP Secure Headers Project that defines a couple of headers that should be set. I remember a common implementation used to be helmet (express based, so a bit outdated), that set a couple of these headers properly.

Would it make sense to have a plugin similar to the CorsPlugin, that allows to set those headers via a builder or do you think everything should be done manually anyway?

Happy to get any opinions and also to collect a list of headers/values if it makes sense to you…

[tipsy]

CSP is already covered, taking a string as an argument.

CSP is quite complex, so I would prefer to have a DSL for it, but I (or someone else) can take care of that part 😃

If we want to support caching headers as well, we probably should rename from secure headers to a more generic concept of pre-configurable headers?

Yeah, I think it’s better to make it a general “header-helper” than just security headers.

[spinscale]

I have created a sample plugin at https://github.com/spinscale/javalin-secure-headers

The basic idea is to have a builder for the plugin to create the proper headers (as typesafe as possible):

final SecureHeadersPlugin plugin = SecureHeadersPlugin.builder()
        .xContentTypeOptionsNoSniff();
        .strictTransportSecurity(Duration.ofSeconds(10), true)
        .xFrameOptions("deny")
        .xPermittedCrossDomainPolicies(CrossDomainPolicy.NONE)
        .referrerPolicy(ReferrerPolicy.STRICT_ORIGIN)
        .clearSiteData(ClearSiteData.COOKIES, ClearSiteData.EXECUTION_CONTEXTS, ClearSiteData.STORAGE)
        .crossOriginEmbedderPolicy(CrossOriginEmbedderPolicy.UNSAFE_NONE)
        .crossOriginOpenerPolicy(CrossOriginOpenerPolicy.SAME_ORIGIN_ALLOW_POPUPS)
        .crossOriginResourcePolicy(CrossOriginResourcePolicy.SAME_SITE)
        .build();

final Javalin javalin = Javalin.create(config -> config.registerPlugin(plugin));

The plugin exists only to make sure we’re talking about the right way of implementing, before getting this into the core.