HTTPS and security headers
On This Lesson 4 topics
This lesson is planned. The outline below lists the topics it will cover. The full lesson has not been published yet.
In this lesson
force encrypted transport and add protective headers.
Planned topics
- HTTPS encrypts traffic; usually terminated at a reverse proxy or load balancer.
- Redirect HTTP to HTTPS, and send HSTS (
Strict-Transport-Security) so browsers insist on HTTPS. - Spring Security adds several headers by default, such as
X-Content-Type-Options: nosniffand cache controls. - Add a
Content-Security-Policysuited to your responses, andReferrer-Policywhere relevant. - Behind a proxy, configure forwarded headers so Spring knows the request was HTTPS (verify the property for the version).
Draft outline details
Demonstration
a response header list with Strict-Transport-Security: max-age=31536000; includeSubDomains.
Check your understanding
What does HSTS tell the browser?
Show answer
Always use HTTPS for this site.
Practice
Apply this lesson with the module's lab, exercises and quiz.
Marking a lesson complete is optional and you can undo it any time. Your progress stays in this browser.