Package filter

Class SecurityHeadersFilter

java.lang.Object

filter.SecurityHeadersFilter

All Implemented Interfaces:

javax.servlet.Filter

public class SecurityHeadersFilter
extends Object
implements javax.servlet.Filter

Filter that adds security headers to HTTP responses which is sent to the browser. Implements Content Security Policy, XSS protection, and other security measures.

Author:

TAMIL MUGHILAN

Constructor Summary

Constructors

Constructor	Description
SecurityHeadersFilter()

Method Summary

Modifier and Type	Method	Description
private void	applySecurityHeaders(javax.servlet.http.HttpServletRequest req, javax.servlet.http.HttpServletResponse res, String nonce)	Applies security headers to the HTTP response.
private String	buildCSPPolicy(String nonce)	Builds the Content Security Policy header value.
void	destroy()	Cleans up resources when filter is destroyed.
void	doFilter(javax.servlet.ServletRequest request, javax.servlet.ServletResponse response, javax.servlet.FilterChain chain)	Processes responses to add security headers.
private String	generateNonce()	Generates random nonce - number used once
void	init(javax.servlet.FilterConfig filterConfig)	Initializes the filter when application starts.

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Constructor Details

SecurityHeadersFilter

public SecurityHeadersFilter()

Method Details

doFilter

public void doFilter(javax.servlet.ServletRequest request,
 javax.servlet.ServletResponse response,
 javax.servlet.FilterChain chain)
              throws IOException,
javax.servlet.ServletException

Processes responses to add security headers. Generates nonce for CSP and applies various security headers.

Specified by:

doFilter in interface javax.servlet.Filter

Parameters:

request - the servlet request

response - the servlet response

chain - the filter chain

Throws:

IOException - if an I/O error occurs

javax.servlet.ServletException - if a servlet error occurs

applySecurityHeaders

private void applySecurityHeaders(javax.servlet.http.HttpServletRequest req,
 javax.servlet.http.HttpServletResponse res,
 String nonce)

Applies security headers to the HTTP response.

Parameters:

req - the HTTP request

res - the HTTP response

nonce - the generated nonce for CSP

generateNonce

private String generateNonce()

Generates random nonce - number used once

Returns:

nonce

buildCSPPolicy

private String buildCSPPolicy(String nonce)

Builds the Content Security Policy header value.

Parameters:

nonce - the nonce to include in script-src

Returns:

the complete CSP policy string

init

public void init(javax.servlet.FilterConfig filterConfig)

Initializes the filter when application starts.

Specified by:

init in interface javax.servlet.Filter

Parameters:

filterConfig - the filter configuration

destroy

public void destroy()

Cleans up resources when filter is destroyed.

Specified by:

destroy in interface javax.servlet.Filter