Skip to content

ATLAS-5160: Remove deprecated X-XSS-PROTECTION header from HTTP response headers initialization and Atlas Spring Security Config #482

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
aditya-gupta36 wants to merge 1 commit into
base: master
Choose a base branch
from
+8 −5
Open

ATLAS-5160: Remove deprecated X-XSS-PROTECTION header from HTTP response headers initialization and Atlas Spring Security Config #482

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
3 changes: 0 additions & 3 deletions webapp/src/main/java/org/apache/atlas/web/filters/HeadersUtil.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -35,12 +35,10 @@ public class HeadersUtil {

public static final String X_FRAME_OPTIONS_KEY = "X-Frame-Options";
public static final String X_CONTENT_TYPE_OPTIONS_KEY = "X-Content-Type-Options";
public static final String X_XSS_PROTECTION_KEY = "X-XSS-Protection";
public static final String STRICT_TRANSPORT_SEC_KEY = "Strict-Transport-Security";
public static final String CONTENT_SEC_POLICY_KEY = "Content-Security-Policy";
public static final String X_FRAME_OPTIONS_VAL = "DENY";
public static final String X_CONTENT_TYPE_OPTIONS_VAL = "nosniff";
public static final String X_XSS_PROTECTION_VAL = "1; mode=block";
public static final String STRICT_TRANSPORT_SEC_VAL = "max-age=31536000; includeSubDomains";
public static final String CONTENT_SEC_POLICY_VAL = "default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval' blob: data:; connect-src 'self'; img-src 'self' blob: data:; style-src 'self' 'unsafe-inline';font-src 'self' data:";
public static final String SERVER_KEY = "Server";
Expand Down Expand Up @@ -79,7 +77,6 @@ public static void initializeHttpResponseHeaders(Properties configuredHeaders) {

HEADER_MAP.put(X_FRAME_OPTIONS_KEY, X_FRAME_OPTIONS_VAL);
HEADER_MAP.put(X_CONTENT_TYPE_OPTIONS_KEY, X_CONTENT_TYPE_OPTIONS_VAL);
HEADER_MAP.put(X_XSS_PROTECTION_KEY, X_XSS_PROTECTION_VAL);
HEADER_MAP.put(STRICT_TRANSPORT_SEC_KEY, STRICT_TRANSPORT_SEC_VAL);
HEADER_MAP.put(CONTENT_SEC_POLICY_KEY, CONTENT_SEC_POLICY_VAL);
HEADER_MAP.put(SERVER_KEY, AtlasConfiguration.HTTP_HEADER_SERVER_VALUE.getString());
Expand Down
3 changes: 2 additions & 1 deletion webapp/src/main/java/org/apache/atlas/web/security/AtlasSecurityConfig.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -195,7 +195,8 @@ protected void configure(HttpSecurity httpSecurity) throws Exception {
//@formatter:off
httpSecurity.authorizeRequests().anyRequest().authenticated()
.and()
.headers()
// Why disable() xssProtection -> By default Spring Security automatically adds security headers unless you disable them. No Modern Browsers support and its replaced by "Content-Security-Policy"
Copy link

Copilot AI Dec 3, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The comment contains a grammatical error. "No Modern Browsers support" should be "No modern browsers support" (lowercase 'm') and should say "support it" for clarity. Consider revising to: "By default Spring Security automatically adds security headers unless you disable them. No modern browsers support it and it's replaced by 'Content-Security-Policy'"

Suggested change
// Why disable() xssProtection -> By default Spring Security automatically adds security headers unless you disable them. No Modern Browsers support and its replaced by "Content-Security-Policy"
// Why disable() xssProtection -> By default Spring Security automatically adds security headers unless you disable them. No modern browsers support it and it's replaced by "Content-Security-Policy"

Copilot uses AI. Check for mistakes.
Copy link
Contributor

@chaitalicod chaitalicod Dec 19, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Check if this comment is required here or make it precise and relevant

.headers().xssProtection().disable()
.addHeaderWriter(new StaticHeadersWriter(HeadersUtil.CONTENT_SEC_POLICY_KEY, HeadersUtil.getHeaderMap(HeadersUtil.CONTENT_SEC_POLICY_KEY)))
.addHeaderWriter(new StaticHeadersWriter(SERVER_KEY, HeadersUtil.getHeaderMap(SERVER_KEY)))
.and()
Expand Down
1 change: 0 additions & 1 deletion webapp/src/test/java/org/apache/atlas/web/filters/HeaderUtilsTest.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -93,7 +93,6 @@ public void testDefaultHeadersArePresent() {

assertEquals("DENY", HeadersUtil.getHeaderMap(HeadersUtil.X_FRAME_OPTIONS_KEY));
assertEquals("nosniff", HeadersUtil.getHeaderMap(HeadersUtil.X_CONTENT_TYPE_OPTIONS_KEY));
assertEquals("1; mode=block", HeadersUtil.getHeaderMap(HeadersUtil.X_XSS_PROTECTION_KEY));
}

private Properties createPropertiesWithHeaders(String... headers) {
Expand Down
6 changes: 6 additions & 0 deletions webapp/src/test/java/org/apache/atlas/web/security/AtlasSecurityConfigTest.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -499,6 +499,7 @@ private void setupHttpSecurityMocksFor(HttpSecurity httpSecurity) throws Excepti
ExpressionUrlAuthorizationConfigurer<HttpSecurity>.ExpressionInterceptUrlRegistry mockAuthRequests = mock(ExpressionUrlAuthorizationConfigurer.ExpressionInterceptUrlRegistry.class);
ExpressionUrlAuthorizationConfigurer<HttpSecurity>.AuthorizedUrl mockAuthorizedUrl = mock(ExpressionUrlAuthorizationConfigurer.AuthorizedUrl.class);
HeadersConfigurer<HttpSecurity> mockHeadersConfigurer = mock(HeadersConfigurer.class);
HeadersConfigurer<HttpSecurity>.XXssConfig mockXssConfigurer = mock(HeadersConfigurer.XXssConfig.class);
ServletApiConfigurer<HttpSecurity> mockServletApiConfigurer = mock(ServletApiConfigurer.class);
CsrfConfigurer<HttpSecurity> mockCsrfConfigurer = mock(CsrfConfigurer.class);
SessionManagementConfigurer<HttpSecurity> mockSessionConfigurer = mock(SessionManagementConfigurer.class);
Expand All @@ -514,6 +515,8 @@ private void setupHttpSecurityMocksFor(HttpSecurity httpSecurity) throws Excepti
when(mockAuthRequests.and()).thenReturn(httpSecurity);

when(httpSecurity.headers()).thenReturn(mockHeadersConfigurer);
when(mockHeadersConfigurer.xssProtection()).thenReturn(mockXssConfigurer);
when(mockXssConfigurer.disable()).thenReturn(mockHeadersConfigurer);
when(mockHeadersConfigurer.addHeaderWriter(any(StaticHeadersWriter.class))).thenReturn(mockHeadersConfigurer);
when(mockHeadersConfigurer.and()).thenReturn(httpSecurity);

Expand Down Expand Up @@ -857,6 +860,7 @@ private void setupHttpSecurityMocks() throws Exception {
ExpressionUrlAuthorizationConfigurer<HttpSecurity>.ExpressionInterceptUrlRegistry mockAuthRequests = mock(ExpressionUrlAuthorizationConfigurer.ExpressionInterceptUrlRegistry.class);
ExpressionUrlAuthorizationConfigurer<HttpSecurity>.AuthorizedUrl mockAuthorizedUrl = mock(ExpressionUrlAuthorizationConfigurer.AuthorizedUrl.class);
HeadersConfigurer<HttpSecurity> mockHeadersConfigurer = mock(HeadersConfigurer.class);
HeadersConfigurer<HttpSecurity>.XXssConfig mockXssConfigurer = mock(HeadersConfigurer.XXssConfig.class);
ServletApiConfigurer<HttpSecurity> mockServletApiConfigurer = mock(ServletApiConfigurer.class);
CsrfConfigurer<HttpSecurity> mockCsrfConfigurer = mock(CsrfConfigurer.class);
SessionManagementConfigurer<HttpSecurity> mockSessionConfigurer = mock(SessionManagementConfigurer.class);
Expand All @@ -872,6 +876,8 @@ private void setupHttpSecurityMocks() throws Exception {
when(mockAuthRequests.and()).thenReturn(mockHttpSecurity);

when(mockHttpSecurity.headers()).thenReturn(mockHeadersConfigurer);
when(mockHeadersConfigurer.xssProtection()).thenReturn(mockXssConfigurer);
when(mockXssConfigurer.disable()).thenReturn(mockHeadersConfigurer);
when(mockHeadersConfigurer.addHeaderWriter(any(StaticHeadersWriter.class))).thenReturn(mockHeadersConfigurer);
when(mockHeadersConfigurer.and()).thenReturn(mockHttpSecurity);

Expand Down
Loading