Examples with BrowserSecurityHeaders org.keycloak.models.BrowserSecurityHeaders used on opensource projects

Example 1 with BrowserSecurityHeaders

use of org.keycloak.models.BrowserSecurityHeaders in project keycloak by keycloak.

the class DefaultSecurityHeadersProvider method addHtmlHeaders.

private void addHtmlHeaders(MultivaluedMap<String, Object> headers) {
    for (BrowserSecurityHeaders header : BrowserSecurityHeaders.values()) {
        addHeader(header, headers);
    }
    // TODO This will be refactored as part of introducing a more strict CSP header
    if (options != null) {
        ContentSecurityPolicyBuilder csp = ContentSecurityPolicyBuilder.create();
        if (options.isAllowAnyFrameAncestor()) {
            headers.remove(BrowserSecurityHeaders.X_FRAME_OPTIONS.getHeaderName());
            csp.frameAncestors(null);
        }
        String allowedFrameSrc = options.getAllowedFrameSrc();
        if (allowedFrameSrc != null) {
            csp.frameSrc(allowedFrameSrc);
        }
        if (CONTENT_SECURITY_POLICY.getDefaultValue().equals(headers.getFirst(CONTENT_SECURITY_POLICY.getHeaderName()))) {
            headers.putSingle(CONTENT_SECURITY_POLICY.getHeaderName(), csp.build());
        }
    }
}

Example 2 with BrowserSecurityHeaders

use of org.keycloak.models.BrowserSecurityHeaders in project keycloak by keycloak.

the class LoginTest method testBrowserSecurityHeaders.

@Test
public void testBrowserSecurityHeaders() {
    Client client = AdminClientUtil.createResteasyClient();
    Response response = client.target(oauth.getLoginFormUrl()).request().get();
    Assert.assertThat(response.getStatus(), is(equalTo(200)));
    for (BrowserSecurityHeaders header : BrowserSecurityHeaders.values()) {
        String headerValue = response.getHeaderString(header.getHeaderName());
        String expectedValue = header.getDefaultValue();
        if (expectedValue.isEmpty()) {
            Assert.assertNull(headerValue);
        } else {
            Assert.assertNotNull(headerValue);
            Assert.assertThat(headerValue, is(equalTo(expectedValue)));
        }
    }
    response.close();
    client.close();
}