From b45f837b517f87166891e7344ea68964094cbc39 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Jakub=20Stromsk=C3=BD?= <kstromsky@gmail.com>
Date: Mon, 7 Nov 2022 14:05:42 +0100
Subject: [PATCH] [#183682057][#183681883] Add security headers

---
 .../ga4gh/dataconnect/ApplicationConfig.java  | 36 +++++++++++++++++++
 1 file changed, 36 insertions(+)

diff --git a/src/main/java/com/dnastack/ga4gh/dataconnect/ApplicationConfig.java b/src/main/java/com/dnastack/ga4gh/dataconnect/ApplicationConfig.java
index 514a3f8..2d92a69 100644
--- a/src/main/java/com/dnastack/ga4gh/dataconnect/ApplicationConfig.java
+++ b/src/main/java/com/dnastack/ga4gh/dataconnect/ApplicationConfig.java
@@ -126,6 +126,18 @@ public DefaultJwtSecurityConfig(Converter<Jwt, ? extends AbstractAuthenticationT
         @Override
         protected void configure(HttpSecurity http) throws Exception {
             http.cors().and()
+                .headers()
+                .frameOptions().deny()
+                .xssProtection().and()
+                .contentSecurityPolicy(
+                    "default-src 'self'; " +
+                    "style-src 'self'; " +
+                    "font-src 'self'; " +
+                    "script-src 'self';" +
+                    "img-src 'self'; " +
+                    "connect-src 'self';"
+                ).and()
+                .and()
                 .authorizeRequests()
                 .antMatchers("/actuator/health", "/actuator/info", "/service-info").permitAll()
                 .antMatchers("/**")
@@ -160,6 +172,18 @@ protected static class WalletJwtSecurityConfig extends WebSecurityConfigurerAdap
         @Override
         protected void configure(HttpSecurity http) throws Exception {
             http.cors().and()
+                .headers()
+                .frameOptions().deny()
+                .xssProtection().and()
+                .contentSecurityPolicy(
+                    "default-src 'self'; " +
+                    "style-src 'self'; " +
+                    "font-src 'self'; " +
+                    "script-src 'self';" +
+                    "img-src 'self'; " +
+                    "connect-src 'self';"
+                ).and()
+                .and()
                 .authorizeRequests()
                 .antMatchers("/actuator/health", "/actuator/info", "/service-info").permitAll()
                 .antMatchers("/**")
@@ -239,6 +263,18 @@ protected static class BasicAuthSecurityConfig extends WebSecurityConfigurerAdap
         @Override
         protected void configure(HttpSecurity http) throws Exception {
             http.cors().and()
+                .headers()
+                .frameOptions().deny()
+                .xssProtection().and()
+                .contentSecurityPolicy(
+                    "default-src 'self'; " +
+                    "style-src 'self'; " +
+                    "font-src 'self'; " +
+                    "script-src 'self';" +
+                    "img-src 'self'; " +
+                    "connect-src 'self';"
+                ).and()
+                .and()
                 .authorizeRequests()
                 .antMatchers("/api/**")
                 .authenticated()