SecurityHeadersFilter

This class sets a number of common security headers on the HTTP request.

NOTE: Because these are security headers, they are "secure by default." If the filter is applied, but these fields are NOT defined in Configuration, the defaults on the filter are NOT omitted, but are instead set to the strictest possible value.

{{play.filters.headers.frameOptions}} - sets frameOptions. Some("DENY") by default.
{{play.filters.headers.xssProtection}} - sets xssProtection. Some("1; mode=block") by default.
{{play.filters.headers.contentTypeOptions}} - sets contentTypeOptions. Some("nosniff") by default.
{{play.filters.headers.permittedCrossDomainPolicies}} - sets permittedCrossDomainPolicies. Some("master-only") by default.
{{play.filters.headers.contentSecurityPolicy}} - sets contentSecurityPolicy. Some("default-src 'self'") by default.

Source: SecurityHeadersFilter.scala
See also: Cross Domain Policy File Specification
Content-Security-Policy
X-XSS-Protection
X-Content-Type-Options
X-Frame-Options

Linear Supertypes

AnyRef, Any

Value Members

final def !=(arg0: Any): Boolean

Definition Classes
AnyRef → Any
final def ##(): Int

Definition Classes
AnyRef → Any
final def ==(arg0: Any): Boolean

Definition Classes
AnyRef → Any
val CONTENT_SECURITY_POLICY_HEADER: String
val DEFAULT_CONTENT_SECURITY_POLICY: String
val DEFAULT_CONTENT_TYPE_OPTIONS: String
val DEFAULT_FRAME_OPTIONS: String
val DEFAULT_PERMITTED_CROSS_DOMAIN_POLICIES: String
val DEFAULT_XSS_PROTECTION: String
val X_CONTENT_TYPE_OPTIONS_HEADER: String
val X_FRAME_OPTIONS_HEADER: String
val X_PERMITTED_CROSS_DOMAIN_POLICIES_HEADER: String
val X_XSS_PROTECTION_HEADER: String
def apply(securityHeaderConfig: ⇒ SecurityHeadersConfig): SecurityHeadersFilter

Convenience method for creating a filter using SecurityHeadersConfig case class.
Convenience method for creating a filter using SecurityHeadersConfig case class. Use this if you have settings that you want to specifically turn off by setting to None.
securityHeaderConfig
returns
def apply(config: api.Configuration): SecurityHeadersFilter

Convenience method for creating a filter using play.api.Configuration.
Convenience method for creating a filter using play.api.Configuration. Good for testing.
config
a configuration object that may contain string settings.
returns
a configured SecurityHeadersFilter.
def apply(): SecurityHeadersFilter

Convenience method for creating a SecurityHeadersFilter that reads settings from application.conf.
Convenience method for creating a SecurityHeadersFilter that reads settings from application.conf. Generally speaking, you'll want to use this or the apply(SecurityHeadersConfig) method.
returns
a configured SecurityHeadersFilter.
final def asInstanceOf[T0]: T0

Definition Classes
Any
def clone(): AnyRef

Attributes
protected[java.lang]
Definition Classes
AnyRef
Annotations
@throws( ... )
final def eq(arg0: AnyRef): Boolean

Definition Classes
AnyRef
def equals(arg0: Any): Boolean

Definition Classes
AnyRef → Any
def finalize(): Unit

Attributes
protected[java.lang]
Definition Classes
AnyRef
Annotations
@throws( classOf[java.lang.Throwable] )
final def getClass(): Class[_]

Definition Classes
AnyRef → Any
def hashCode(): Int

Definition Classes
AnyRef → Any
final def isInstanceOf[T0]: Boolean

Definition Classes
Any
final def ne(arg0: AnyRef): Boolean

Definition Classes
AnyRef
final def notify(): Unit

Definition Classes
AnyRef
final def notifyAll(): Unit

Definition Classes
AnyRef
final def synchronized[T0](arg0: ⇒ T0): T0

Definition Classes
AnyRef
def toString(): String

Definition Classes
AnyRef → Any
final def wait(): Unit

Definition Classes
AnyRef
Annotations
@throws( ... )
final def wait(arg0: Long, arg1: Int): Unit

Definition Classes
AnyRef
Annotations
@throws( ... )
final def wait(arg0: Long): Unit

Definition Classes
AnyRef
Annotations
@throws( ... )

object SecurityHeadersFilter

Value Members

final def !=(arg0: Any): Boolean

final def ##(): Int

final def ==(arg0: Any): Boolean

val CONTENT_SECURITY_POLICY_HEADER: String

val DEFAULT_CONTENT_SECURITY_POLICY: String

val DEFAULT_CONTENT_TYPE_OPTIONS: String

val DEFAULT_FRAME_OPTIONS: String

val DEFAULT_PERMITTED_CROSS_DOMAIN_POLICIES: String

val DEFAULT_XSS_PROTECTION: String

val X_CONTENT_TYPE_OPTIONS_HEADER: String

val X_FRAME_OPTIONS_HEADER: String

val X_PERMITTED_CROSS_DOMAIN_POLICIES_HEADER: String

val X_XSS_PROTECTION_HEADER: String

def apply(securityHeaderConfig: ⇒ SecurityHeadersConfig): SecurityHeadersFilter

def apply(config: api.Configuration): SecurityHeadersFilter

def apply(): SecurityHeadersFilter

final def asInstanceOf[T0]: T0

def clone(): AnyRef

final def eq(arg0: AnyRef): Boolean

def equals(arg0: Any): Boolean

def finalize(): Unit

final def getClass(): Class[_]

def hashCode(): Int

final def isInstanceOf[T0]: Boolean

final def ne(arg0: AnyRef): Boolean

final def notify(): Unit

final def notifyAll(): Unit

final def synchronized[T0](arg0: ⇒ T0): T0

def toString(): String

final def wait(): Unit

final def wait(arg0: Long, arg1: Int): Unit

final def wait(arg0: Long): Unit

Inherited from AnyRef

Inherited from Any

Ungrouped