From e368414006c9fcd497be55720f23217ce07b54fe Mon Sep 17 00:00:00 2001 From: geonhos Date: Mon, 13 May 2024 08:59:08 +0900 Subject: [PATCH] =?UTF-8?q?admin:=20security=20header=20=EA=B8=B0=EB=B3=B8?= =?UTF-8?q?=20=EB=B3=B4=EC=95=88=20=EA=B8=B0=EB=8A=A5=20=EC=B6=94=EA=B0=80?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- .../com/bpgroup/poc/admin/security/SecurityConfig.java | 10 ++++++++++ 1 file changed, 10 insertions(+) diff --git a/poc/admin/src/main/java/com/bpgroup/poc/admin/security/SecurityConfig.java b/poc/admin/src/main/java/com/bpgroup/poc/admin/security/SecurityConfig.java index 46a10e6..9733e23 100644 --- a/poc/admin/src/main/java/com/bpgroup/poc/admin/security/SecurityConfig.java +++ b/poc/admin/src/main/java/com/bpgroup/poc/admin/security/SecurityConfig.java @@ -5,9 +5,11 @@ import com.bpgroup.poc.admin.security.authentication.AuthenticationFailException import lombok.RequiredArgsConstructor; import org.springframework.context.annotation.Bean; import org.springframework.context.annotation.Configuration; +import org.springframework.security.config.Customizer; import org.springframework.security.config.annotation.web.builders.HttpSecurity; import org.springframework.security.crypto.bcrypt.BCryptPasswordEncoder; import org.springframework.security.web.SecurityFilterChain; +import org.springframework.security.web.header.writers.XXssProtectionHeaderWriter; import org.springframework.security.web.util.matcher.AntPathRequestMatcher; import java.util.Objects; @@ -22,6 +24,14 @@ public class SecurityConfig { @Bean SecurityFilterChain defaultSecurityFilterChain(HttpSecurity http) throws Exception { + // 보안 기본 설정 + http.headers(c -> c + .frameOptions(fo -> fo.sameOrigin()) // X-Frame-Options: Same Origin + .xssProtection(xp -> xp.headerValue(XXssProtectionHeaderWriter.HeaderValue.ENABLED_MODE_BLOCK)) // X-XSS-Protection: 1; mode=block + .contentTypeOptions(Customizer.withDefaults()) // X-Content-Type-Options: nosniff + .cacheControl(cache -> cache.disable()) //ERR_CACHE_MISS + ); + // 인증 설정 http.authorizeHttpRequests(c -> c .requestMatchers("/css/**", "/images/**", "/js/**").permitAll()