Packages

object SecurityHeadersFilter

This class sets a number of common security headers on the HTTP request.

NOTE: Because these are security headers, they are "secure by default." If the filter is applied, but these fields are NOT defined in Configuration, the defaults on the filter are NOT omitted, but are instead set to the strictest possible value.

  • {{play.filters.headers.frameOptions}} - sets frameOptions. Some("DENY") by default.
  • {{play.filters.headers.xssProtection}} - sets xssProtection. Some("1; mode=block") by default.
  • {{play.filters.headers.contentTypeOptions}} - sets contentTypeOptions. Some("nosniff") by default.
  • {{play.filters.headers.permittedCrossDomainPolicies}} - sets permittedCrossDomainPolicies. Some("master-only") by default.
  • {{play.filters.headers.contentSecurityPolicy}} - sets contentSecurityPolicy. Some("default-src 'self'") by default.
  • {{play.filters.headers.referrerPolicy}} - sets referrerPolicy. Some("origin-when-cross-origin, strict-origin-when-cross-origin") by default.
  • {{play.filters.headers.allowActionSpecificHeaders}} - sets whether .withHeaders may be used to provide page-specific overrides. False by default.
Source
SecurityHeadersFilter.scala
See also

X-Frame-Options

X-Content-Type-Options

X-XSS-Protection

Content-Security-Policy

Cross Domain Policy File Specification

Referrer Policy

Linear Supertypes
AnyRef, Any
Ordering
  1. Alphabetic
  2. By Inheritance
Inherited
  1. SecurityHeadersFilter
  2. AnyRef
  3. Any
  1. Hide All
  2. Show All
Visibility
  1. Public
  2. All

Value Members

  1. val CONTENT_SECURITY_POLICY_HEADER: String
  2. val REFERRER_POLICY: String
  3. val X_CONTENT_TYPE_OPTIONS_HEADER: String
  4. val X_FRAME_OPTIONS_HEADER: String
  5. val X_PERMITTED_CROSS_DOMAIN_POLICIES_HEADER: String
  6. val X_XSS_PROTECTION_HEADER: String
  7. def apply(config: api.Configuration): SecurityHeadersFilter

    Convenience method for creating a filter using play.api.Configuration.

    Convenience method for creating a filter using play.api.Configuration. Good for testing.

    config

    a configuration object that may contain string settings.

    returns

    a configured SecurityHeadersFilter.

  8. def apply(config: SecurityHeadersConfig = SecurityHeadersConfig()): SecurityHeadersFilter

    Convenience method for creating a SecurityHeadersFilter that reads settings from application.conf.

    Convenience method for creating a SecurityHeadersFilter that reads settings from application.conf. Generally speaking, you'll want to use this or the apply(SecurityHeadersConfig) method.

    returns

    a configured SecurityHeadersFilter.