Missing Security Headers (ARCH4141)

Key java.security.missing-security-headers · Severity info · Category security · CWE CWE-693

Omitting key security headers such as CSP, X-Content-Type-Options, and HSTS disables browser-side defenses and opens room for XSS, MIME-sniffing, and protocol-downgrade attacks. Set these headers on every response.

Incorrect

@Bean
SecurityFilterChain chain(HttpSecurity http) throws Exception {
    http.headers(headers -> headers.disable()); // no security headers
    return http.build();
}

Correct

@Bean
SecurityFilterChain chain(HttpSecurity http) throws Exception {
    http.headers(headers -> headers
        .contentSecurityPolicy(csp -> csp.policyDirectives("default-src 'self'"))
        .httpStrictTransportSecurity(hsts -> hsts.includeSubDomains(true)));
    return http.build();
}

Fix

Add security headers such as CSP, X-Content-Type-Options, and HSTS to responses.