javascript - 如何在 Spring Boot 应用程序中设置 header X-Content-Type-Options "nosniff"？

Question

Anti-MIME-Sniffing header X-Content-Type-Options 未设置为“nosniff”。

这允许旧版本的 Internet Explorer 和 Chrome 对响应主体执行 MIME 嗅探，可能导致响应主体被解释和显示为声明的内容类型以外的内容类型。当前(2014 年初)和旧版本的 Firefox 将使用声明的内容类型(如果已设置)，而不是执行 MIME 嗅探。

Answer 1

1. 在您的构建中包含 spring 安全性 (build.gradle)

   编译组:'org.springframework.boot'，名称:'spring-boot-starter-security'，版本:'2.1.4.RELEASE'

或 pom.xml。

<dependency>
    <groupId>org.springframework.boot</groupId>
    <artifactId>spring-boot-starter-security</artifactId>
    <version>2.1.2.RELEASE</version>
</dependency>

引用:https://mvnrepository.com/artifact/org.springframework.boot/spring-boot-starter-security/2.1.2.RELEASE

1. 添加下面的java代码。

   导入 org.springframework.security.config.annotation.web.builders.HttpSecurity;

   导入org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;

   导入org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter;

   @EnableWebSecurity
   public class WebSecurityConfig extends WebSecurityConfigurerAdapter {
   
       @Override
       protected void configure(HttpSecurity http) throws Exception {
           http.csrf().disable();
   
       }
   }
   

之前:

Content-Type →application/json;charset=UTF-8
Date →Wed, 15 May 2019 19:05:00 GMT
X-Auth-Token →5178dc4e-eac5-40be-9ded-dcfa85c644b6
X-B3-Spanid →3d9a5b2fd21b075c
X-B3-Traceid →3d9a5b2fd21b075c
X-Vcap-Request-Id →4988b251-c2c5-4c5f-558b-ed6bce724e1f
Content-Length →992

之后:

X-B3-TraceId →51e54c950ae24fa1
X-B3-SpanId →51e54c950ae24fa1
X-Content-Type-Options →nosniff
X-XSS-Protection →1; mode=block
Cache-Control →no-cache, no-store, max-age=0, must-revalidate
Pragma →no-cache
Expires →0
X-Frame-Options →DENY
x-auth-token →92195048-341d-48a7-93a6-f6f0446f3f0c
Content-Type →application/json;charset=UTF-8
Transfer-Encoding →chunked
Date →Fri, 17 May 2019 15:50:59 GMT