Package io.jans.configapi.filters

Class SecurityResponseHeadersFilter

java.lang.Object
io.jans.configapi.filters.SecurityResponseHeadersFilter
All Implemented Interfaces:
jakarta.ws.rs.container.ContainerResponseFilter
@Provider @Priority(3000) public class SecurityResponseHeadersFilter extends Object implements jakarta.ws.rs.container.ContainerResponseFilter
Applies a fixed set of standard HTTP security response headers to every Config API response, regardless of resource, status code, or exception mapper output. Headers applied: - Content-Security-Policy: frame-ancestors 'none' (blocks framing at the CSP level) - X-Frame-Options: DENY (legacy fallback for the same policy) - X-Content-Type-Options: nosniff - Referrer-Policy: no-referrer Registered as a JAX-RS provider so it runs on the response path for every resource method in the deployment - no per-endpoint annotation required. Priority is set to run late (HEADER_DECORATOR) so it executes after other response filters and cannot be short-circuited by them, and it does not overwrite a header a resource/filter has already set intentionally to a different, more specific value.

  • Constructor Details

    • SecurityResponseHeadersFilter

      public SecurityResponseHeadersFilter()

  • Method Details

    • filter

      public void filter(jakarta.ws.rs.container.ContainerRequestContext requestContext, jakarta.ws.rs.container.ContainerResponseContext responseContext) throws IOException
      Specified by:
      filter in interface jakarta.ws.rs.container.ContainerResponseFilter
      Throws:
      IOException