@Test public void testHeaders() throws Exception { this.target.handleRequest(this.exchange); assertHeader(SecurityHeaders.FRAME_OPTIONS); assertHeader(SecurityHeaders.XSS_PROTECTION); assertHeader(SecurityHeaders.CONTENT_TYPE_OPTIONS); }
@Override public void handleRequest(HttpServerExchange exchange) throws Exception { OptionMap config = exchange.getAttachment(Core.CONFIG); HeaderMap rh = exchange.getResponseHeaders(); rh.add(SecurityHeaders.FRAME_OPTIONS, config.get(Config.FRAME_OPTIONS)); if (config.get(Config.USE_XSS_PROTECTION)) { rh.add(SecurityHeaders.XSS_PROTECTION, "1; mode=block"); } if (config.get(Config.USE_CONTENT_TYPE_OPTIONS)) { rh.add(SecurityHeaders.CONTENT_TYPE_OPTIONS, "nosniff"); } exchange.addExchangeCompleteListener((ex, next) -> { try { if (rh.contains(Headers.CONTENT_TYPE) == false && rh.contains(Headers.SEC_WEB_SOCKET_ACCEPT) == false) { LOG.warn(ex.getRequestURI() + " Content-Type header doesn't exist."); } } finally { next.proceed(); } }); next.handleRequest(exchange); }
SecurityHandler implements HttpHandler { @Override public void handleRequest(HttpServerExchange exchange) throws Exception { OptionMap config = exchange.getAttachment(Core.CONFIG); HeaderMap rh = exchange.getResponseHeaders(); rh.add(SecurityHeaders.FRAME_OPTIONS, config.get(Config.FRAME_OPTIONS)); if (config.get(Config.USE_XSS_PROTECTION)) { rh.add(SecurityHeaders.XSS_PROTECTION, "1; mode=block"); } if (config.get(Config.USE_CONTENT_TYPE_OPTIONS)) { rh.add(SecurityHeaders.CONTENT_TYPE_OPTIONS, "nosniff"); } exchange.addExchangeCompleteListener((ex, next) -> { try { if (rh.contains(Headers.CONTENT_TYPE) == false && rh.contains(Headers.SEC_WEB_SOCKET_ACCEPT) == false) { LOG.warn(ex.getRequestURI() + " Content-Type header doesn't exist."); } } finally { next.proceed(); } }); next.handleRequest(exchange); } }
SecurityHandler implements HttpHandler { @Override public void handleRequest(HttpServerExchange exchange) throws Exception { OptionMap config = exchange.getAttachment(Core.CONFIG); HeaderMap rh = exchange.getResponseHeaders(); rh.add(SecurityHeaders.FRAME_OPTIONS, config.get(Config.FRAME_OPTIONS)); if (config.get(Config.USE_XSS_PROTECTION)) { rh.add(SecurityHeaders.XSS_PROTECTION, "1; mode=block"); } if (config.get(Config.USE_CONTENT_TYPE_OPTIONS)) { rh.add(SecurityHeaders.CONTENT_TYPE_OPTIONS, "nosniff"); } exchange.addExchangeCompleteListener((ex, next) -> { try { if (rh.contains(Headers.CONTENT_TYPE) == false && rh.contains(Headers.SEC_WEB_SOCKET_ACCEPT) == false) { LOG.warn(ex.getRequestURI() + " Content-Type header doesn't exist."); } } finally { next.proceed(); } }); next.handleRequest(exchange); } SecurityHandler(HttpHandler next); }
SecurityHandler implements HttpHandler { @Override public void handleRequest(HttpServerExchange exchange) throws Exception { OptionMap config = exchange.getAttachment(Core.CONFIG); HeaderMap rh = exchange.getResponseHeaders(); rh.add(SecurityHeaders.FRAME_OPTIONS, config.get(Config.FRAME_OPTIONS)); if (config.get(Config.USE_XSS_PROTECTION)) { rh.add(SecurityHeaders.XSS_PROTECTION, "1; mode=block"); } if (config.get(Config.USE_CONTENT_TYPE_OPTIONS)) { rh.add(SecurityHeaders.CONTENT_TYPE_OPTIONS, "nosniff"); } exchange.addExchangeCompleteListener((ex, next) -> { try { if (rh.contains(Headers.CONTENT_TYPE) == false && rh.contains(Headers.SEC_WEB_SOCKET_ACCEPT) == false) { LOG.warn(ex.getRequestURI() + " Content-Type header doesn't exist."); } } finally { next.proceed(); } }); next.handleRequest(exchange); } SecurityHandler(HttpHandler next); @Override void handleRequest(HttpServerExchange exchange); }
SecurityHandler implements HttpHandler { @Override public void handleRequest(HttpServerExchange exchange) throws Exception { OptionMap config = exchange.getAttachment(Core.CONFIG); HeaderMap rh = exchange.getResponseHeaders(); rh.add(SecurityHeaders.FRAME_OPTIONS, config.get(Config.FRAME_OPTIONS)); if (config.get(Config.USE_XSS_PROTECTION)) { rh.add(SecurityHeaders.XSS_PROTECTION, "1; mode=block"); } if (config.get(Config.USE_CONTENT_TYPE_OPTIONS)) { rh.add(SecurityHeaders.CONTENT_TYPE_OPTIONS, "nosniff"); } exchange.addExchangeCompleteListener((ex, next) -> { try { if (rh.contains(Headers.CONTENT_TYPE) == false && rh.contains(Headers.SEC_WEB_SOCKET_ACCEPT) == false) { LOG.warn(ex.getRequestURI() + " Content-Type header doesn't exist."); } } finally { next.proceed(); } }); next.handleRequest(exchange); } SecurityHandler(HttpHandler next); @Override void handleRequest(HttpServerExchange exchange);  }