Package io.karatelabs.http

Class SecurityHeaders

java.lang.Object
io.karatelabs.http.SecurityHeaders
public class SecurityHeaders extends Object
Applies security headers to HTTP responses to protect against common web vulnerabilities.

Headers applied:

  • X-Content-Type-Options: nosniff - Prevents MIME type sniffing attacks
  • X-Frame-Options: DENY - Prevents clickjacking by disallowing iframe embedding
  • X-XSS-Protection: 1; mode=block - Enables browser XSS filtering (legacy)
  • Content-Security-Policy - Controls resource loading (if configured)
  • Strict-Transport-Security - Enforces HTTPS (if configured, non-dev mode only)
  • Referrer-Policy - Controls referrer information (if configured)

Usage: 

 ServerConfig config = new ServerConfig()
     .securityHeadersEnabled(true)
     .contentSecurityPolicy("default-src 'self'")
     .hstsEnabled(true);

 // In RequestHandler, after preparing response:
 SecurityHeaders.apply(response, config);

  • Constructor Details

    • SecurityHeaders

      public SecurityHeaders()

  • Method Details

    • apply

      public static void apply(HttpResponse response, ServerConfig config)
      Apply security headers to an HTTP response based on the server configuration.
      Parameters:
      response - the HTTP response to add headers to
      config - the server configuration containing security settings

    • isHtmlResponse

      public static boolean isHtmlResponse(String contentType)
      Check if the given content type is HTML (requires security headers).
      Parameters:
      contentType - the content type header value
      Returns:
      true if this is an HTML response