CODEWITHSUNDEEP
spring-bootspring-securityxss
gtludwig
gtludwig

Reputation: 5611

Is it possible to implement only XSS prevention in Spring security and leave everything else open?

I'm working on a project where the OAuth2 implementation has not yet been consolidated, but I have been requested to investigate XSS prevention on the platform. Since the security concern is a known vulnerability, can Spring Security be in place to prevent XSS only and disable any form of authorization and authentication?

Upvotes: 0

Views: 342

Answers (1)

jzheaux
jzheaux

Reputation: 7762

Yes, though there may be some things that you will still want, like Spring Security's application firewall.

By default, HttpSecurity will add http basic, form login, CSRF protection, and various security headers, but these can all be configured. The following leaves only the X-XSS-Protection header in place:

@EnableWebSecurity
public class SecurityConfig extends WebSecurityConfigurerAdapter {
    @Override
    protected void configure(HttpSecurity http) {
        http
            .csrf().disable()
            .headers()
                .defaultsDisabled()
                .xssProtection()
    }
}

Upvotes: 1

Related Questions