anchor.diff:  ----
   
   [[webflux-headers-hsts]]
  -==== HTTP Strict Transport Security (HSTS)
  +== HTTP Strict Transport Security (HSTS)
   When you type in your bank's website, do you enter mybank.example.com or do you enter https://mybank.example.com[]?
   If you omit the https protocol, you are potentially vulnerable to http://en.wikipedia.org/wiki/Man-in-the-middle_attack[Man in the Middle attacks].
   Even if the website performs a redirect to https://mybank.example.com a malicious user could intercept the initial HTTP request and manipulate the response (i.e. redirect to https://mibank.example.com and steal their credentials).
  
positive.code: ----
  
  [[webflux-headers-cache-control]]
  ==== Cache Control
  In the past Spring Security required you to provide your own cache control for your web application.
  This seemed reasonable at the time, but browser caches have evolved to include caches for secure connections as well.
  This means that a user may view an authenticated page, log out, and then a malicious user can use the browser history to view the cached page.
  
negative.code: 
  [[webflux-headers]]
   Security HTTP Response Headers
  This section discusses Spring Security's support for adding various security headers to the response of WebFlux.
  
  = Default Security Headers
  Spring Security allows users to easily inject the default security headers to assist in protecting their application.
  The default for Spring Security is to include the following headers:
  
  