anchor.diff:  	return http.build();
   }
   ----
  +
  +.Kotlin
  +[source,kotlin,role="secondary"]
  +----
  +@Bean
  +fun webFilterChain(http: ServerHttpSecurity): SecurityWebFilterChain {
  +    return http {
  +        // ...
  +        headers {
  +            contentSecurityPolicy {
  +                policyDirectives = "script-src 'self' https://trustedscripts.example.com; object-src https://trustedplugins.example.com; report-uri /csp-report-endpoint/"
  +                reportOnly = true
  +            }
  +        }
  +    }
  +}
  +----
   ====
   
   [[webflux-headers-referrer]]
   == Referrer Policy
   
   Spring Security does not add <<headers-referrer,Referrer Policy>> headers by default.
  -You can enable the Referrer Policy header using Java configuration as shown below:
  -
  -.Referrer Policy Java Configuration
  -====
  -[source,java]
  +You can enable the Referrer Policy header using configuration as shown below:
  +
  +.Referrer Policy Configuration
  +====
  +.Java
  +[source,java,role="primary"]
   ----
   @Bean
   SecurityWebFilterChain springSecurityFilterChain(ServerHttpSecurity http) {
  
positive.code: == HTTP Strict Transport Security (HSTS)
  Spring Security provides the <<headers-hsts,Strict Transport Security>> header by default.
  However, you can customize the results explicitly.
  For example, the following is an example of explicitly providing HSTS with Java Configuration:
  
  .Strict Transport Security with Java Configuration
  ====
  [source,java]
  ----
  @Bean
  SecurityWebFilterChain springSecurityFilterChain(ServerHttpSecurity http) {
  
negative.code: 		// ...
  		.headers(headers -> headers.disable());
  	return http.build();
  }
  ----
  
  .Kotlin
  [source,kotlin,role="secondary"]
  ----
  @Bean
  fun webFilterChain(http: ServerHttpSecurity): SecurityWebFilterChain {
      return http {
          // ...
          headers {
              disable()
          }
      }
  }
  ----
  ====
  