anchor.diff:  ----
   
   [[webflux-headers-xss-protection]]
  -==== X-XSS-Protection
  +== X-XSS-Protection
   Some browsers have built in support for filtering out https://www.owasp.org/index.php/Testing_for_Reflected_Cross_site_scripting_(OWASP-DV-001)[reflected XSS attacks].
   This is by no means foolproof, but does assist in XSS protection.
   
  
positive.code: ----
  
  [[webflux-headers-hsts]]
  ==== HTTP Strict Transport Security (HSTS)
  When you type in your bank's website, do you enter mybank.example.com or do you enter https://mybank.example.com[]?
  If you omit the https protocol, you are potentially vulnerable to http://en.wikipedia.org/wiki/Man-in-the-middle_attack[Man in the Middle attacks].
  Even if the website performs a redirect to https://mybank.example.com a malicious user could intercept the initial HTTP request and manipulate the response (i.e. redirect to https://mibank.example.com and steal their credentials).
  
negative.code: 
  [[webflux-headers]]
   Security HTTP Response Headers
  This section discusses Spring Security's support for adding various security headers to the response of WebFlux.
  
  = Default Security Headers
  Spring Security allows users to easily inject the default security headers to assist in protecting their application.
  The default for Spring Security is to include the following headers:
  
  