英文:
Spring boot web application does not have cache-control header
问题
我正在使用Spring Boot应用程序，有一个要求是通过禁用网页之间的缓存来启用安全性。
据我了解，默认情况下，Spring Security会为我们设置特定的缓存控制头值，无需我们配置任何内容。
但是对于我的Web应用程序，以下响应头未出现。
Cache-Control"，"no-store"
Pragma"，"no-cache"
Expires"，"0"
我尝试使用拦截器（实现HandlerInterceptor）设置它们，并在preHandle、postHandle和afterCompletionMethod中添加以下代码。
response.setHeader("Cache-Control", "no-store"); // HTTP 1.1.
response.setHeader("Pragma", "no-cache"); // HTTP 1.0.
response.setHeader("Expires", "0"); // 代理。
尽管控制权传递到这些方法并设置了标头，但当我检查Web浏览器时，我看不到这些标头。
可能的原因是什么？
英文:
I am using a Spring boot application and there is a requirement to enable security by disabling the caching between the web-pages.
As I understand, by default, Spring Security sets specific cache-control header values for us, without us having to configure anything.
But for my web application, the following response headers are not present.
Cache-Control", "no-store"
Pragma", "no-cache"
Expires", "0"
I have tried setting them using an interceptor(implementing HandlerInterceptor) and adding the following code in the preHandle, postHandle and afterCompletionMethod.
response.setHeader("Cache-Control", "no-store"); // HTTP 1.1.
response.setHeader("Pragma", "no-cache"); // HTTP 1.0.
response.setHeader("Expires", "0"); // Proxies.
Although the control comes to these methods and the header is set, when I inspect the web-browser, I don't see these headers.
What could be the reason?
答案1
得分: 3
以下是翻译好的部分：
有不同的方法来设置标头。
我建议使用过滤器或配置来设置它。
配置
默认情况下，Spring Boot 设置安全标头。通过.defaultsDisabled()，您可以禁用它们并有选择地激活所需的标头。
@EnableWebSecurity
public class WebSecurityConfig extends WebSecurityConfigurerAdapter {
@Override
protected void configure(HttpSecurity http) throws Exception {
http
// ...
.headers()
// 除非明确列出，否则不要使用任何默认标头
.defaultsDisabled()
.cacheControl();
}
}
将标头设置为以下设置：
Cache-Control: no-cache, no-store, max-age=0, must-revalidate
Pragma: no-cache
Expires: 0
有关配置的更多详细信息，请参阅文档：https://docs.spring.io/spring-security/site/docs/4.0.x/reference/html/headers.html
或者，您可以使用过滤器。
过滤器
@WebFilter("/filter-response-header/*")
public class AddResponseHeaderFilter implements Filter {
@Override
public void doFilter(ServletRequest request, ServletResponse response,
FilterChain chain) throws IOException, ServletException {
HttpServletResponse httpServletResponse = (HttpServletResponse) response;
httpServletResponse.setHeader("Cache-Control", "no-store");
httpServletResponse.setHeader("Pragma", "no-cache");
httpServletResponse.setHeader("Expires", "0");
chain.doFilter(request, response);
}
}
对于单个响应
HttpServletResponse：
HttpServletResponse response;
response.addHeader("Cache-Control", "no-store");
response.addHeader("Pragma", "no-cache");
response.addHeader("Expires", "0");
要了解更多，请参阅此处：https://www.baeldung.com/spring-response-header
英文:
There are different types of setting the header.
I would suggest to set it either with a filter or the configuration.
Configuration
By default spring-boot sets security headers. With the .defaultsDisabled() you disable them and can selective activate the wanted headers.
@EnableWebSecurity
public class WebSecurityConfig extends
WebSecurityConfigurerAdapter {
@Override
protected void configure(HttpSecurity http) throws Exception {
http
// ...
.headers()
// do not use any default headers unless explicitly listed
.defaultsDisabled()
.cacheControl();
}
}
Will set the header to following settings:
Cache-Control: no-cache, no-store, max-age=0, must-revalidate
Pragma: no-cache
Expires: 0
For more detail of the configuration here is the doc. https://docs.spring.io/spring-security/site/docs/4.0.x/reference/html/headers.html
Alternative you can yous a filter.
Filter
@WebFilter("/filter-response-header/*")
public class AddResponseHeaderFilter implements Filter {
@Override
public void doFilter(ServletRequest request, ServletResponse response,
FilterChain chain) throws IOException, ServletException {
HttpServletResponse httpServletResponse = (HttpServletResponse) response;
httpServletResponse.setHeader(
"Cache-Control", "no-store");
httpServletResponse.setHeader(
"Pragma", "no-cache");
httpServletResponse.setHeader(
"Expires", "0");
chain.doFilter(request, response);
}
For a single response
HttpServletResponse:
HttpServletResponse response
response.addHeader("Cache-Control", "no-store");
response.addHeader("Pragma", "no-cache");
response.addHeader("Expires", "0");
for more have a look here: https://www.baeldung.com/spring-response-header
通过集体智慧和协作来改善编程学习和解决问题的方式。致力于成为全球开发者共同参与的知识库，让每个人都能够通过互相帮助和分享经验来进步。
评论