title: How To Set Strict-Transport-Security Header for /favicon.ico in Spring Boot
body: <p>My Spring Boot application (v1.4.2, with undertow starter) is currently setting the Strict-Transport-Security header for every resource it serves up, including API resources from my spring-web RestControllers, and static resources in <code>/src/main/resources/static</code>.  The <em><strong>only</strong></em> exception I've found is <code>/favicon.ico</code>. The missing header on this file is triggering findings in our security scans and I'd like to clear them up.</p>
  
  <p>Here's what I've tried so far: </p>
  
  <ol>
  <li>Disabled Spring's <a href="https://docs.spring.io/spring-boot/docs/current/reference/html/boot-features-developing-web-applications.html#boot-features-spring-mvc-favicon" rel="nofollow noreferrer">custom favicon handling</a> with <code>spring.mvc.favicon.enabled=false</code></li>
  <li><p>Added <a href="https://docs.spring.io/spring-security/site/docs/4.0.2.RELEASE/reference/html/headers.html#headers-hsts" rel="nofollow noreferrer">explicit header handling</a> for all resources in HttpSecurity configuration:</p>
  
  <pre><code>@EnableWebSecurity
  public class WebSecurityConfig extends WebSecurityConfigurerAdapter {
  
      @Override
      protected void configure(HttpSecurity http) {
          http.headers()
              .httpStrictTransportSecurity()
              .requestMatcher(request -&gt; true);
      }
  }
  </code></pre></li>
  </ol>
  
  <p>It seems no matter what I do, this resource produces a different set of HTTP response headers than every other resource served up by Spring Boot. For instance, the cache control headers that are applied to all my other responses are absent from <code>/favicon.ico</code>.</p>
  
  <p>Interestingly, I've found that the one header I am able to affect for this file is the Content-Type header (default behavior returns <code>Content-Type: application/octet-stream</code>) by adding a MimeMapping to a EmbeddedServletContainerCustomizer: </p>
  
  <pre><code>@Configuration
  public class WebConfigurer implements EmbeddedServletContainerCustomizer {
  
      @Override
      public void customize(ConfigurableEmbeddedServletContainer container) {
          MimeMappings mappings = new MimeMappings(MimeMappings.DEFAULT);
          mappings.add("ico", "image/x-icon");
          container.setMimeMappings(mappings);
      }
  }
  </code></pre>