This is an automated email from the ASF dual-hosted git repository.
mandarambawane pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/atlas.git
The following commit(s) were added to refs/heads/master by this push:
new bc3c272e8 ATLAS-5160: Remove deprecated X-XSS-Protection response
header (#774)
bc3c272e8 is described below
commit bc3c272e89d7ce6a01b71a8b57250eb4b4e48b55
Author: pareshd <[email protected]>
AuthorDate: Mon Sep 28 20:35:15 2026 +0530
ATLAS-5160: Remove deprecated X-XSS-Protection response header (#774)
Stop sending X-XSS-Protection from default HTTP headers and disable Spring
Security's XSS protection header in favor of Content-Security-Policy.
Co-authored-by: Paresh Devalia <[email protected]>
---
.../java/org/apache/atlas/server/common/filters/HeadersUtil.java | 3 ---
.../apache/atlas/server/common/security/AtlasSecurityConfig.java | 3 ++-
.../src/test/java/org/apache/atlas/web/filters/HeaderUtilsTest.java | 1 -
.../java/org/apache/atlas/web/security/AtlasSecurityConfigTest.java | 6 ++++++
4 files changed, 8 insertions(+), 5 deletions(-)
diff --git
a/server-common/src/main/java/org/apache/atlas/server/common/filters/HeadersUtil.java
b/server-common/src/main/java/org/apache/atlas/server/common/filters/HeadersUtil.java
index b037144b0..f6781b0a9 100644
---
a/server-common/src/main/java/org/apache/atlas/server/common/filters/HeadersUtil.java
+++
b/server-common/src/main/java/org/apache/atlas/server/common/filters/HeadersUtil.java
@@ -37,12 +37,10 @@ public class HeadersUtil {
public static final String X_FRAME_OPTIONS_KEY =
"X-Frame-Options";
public static final String X_CONTENT_TYPE_OPTIONS_KEY =
"X-Content-Type-Options";
- public static final String X_XSS_PROTECTION_KEY =
"X-XSS-Protection";
public static final String STRICT_TRANSPORT_SEC_KEY =
"Strict-Transport-Security";
public static final String CONTENT_SEC_POLICY_KEY =
"Content-Security-Policy";
public static final String X_FRAME_OPTIONS_VAL = "DENY";
public static final String X_CONTENT_TYPE_OPTIONS_VAL = "nosniff";
- public static final String X_XSS_PROTECTION_VAL = "1;
mode=block";
public static final String STRICT_TRANSPORT_SEC_VAL =
"max-age=31536000; includeSubDomains";
public static final String CONTENT_SEC_POLICY_VAL =
"default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval' blob:
data:; connect-src 'self'; img-src 'self' blob: data:; style-src 'self'
'unsafe-inline';font-src 'self' data:";
public static final String SERVER_KEY = "Server";
@@ -81,7 +79,6 @@ public class HeadersUtil {
HEADER_MAP.put(X_FRAME_OPTIONS_KEY, X_FRAME_OPTIONS_VAL);
HEADER_MAP.put(X_CONTENT_TYPE_OPTIONS_KEY, X_CONTENT_TYPE_OPTIONS_VAL);
- HEADER_MAP.put(X_XSS_PROTECTION_KEY, X_XSS_PROTECTION_VAL);
HEADER_MAP.put(STRICT_TRANSPORT_SEC_KEY, STRICT_TRANSPORT_SEC_VAL);
HEADER_MAP.put(CONTENT_SEC_POLICY_KEY, CONTENT_SEC_POLICY_VAL);
HEADER_MAP.put(SERVER_KEY,
AtlasConfiguration.HTTP_HEADER_SERVER_VALUE.getString());
diff --git
a/server-common/src/main/java/org/apache/atlas/server/common/security/AtlasSecurityConfig.java
b/server-common/src/main/java/org/apache/atlas/server/common/security/AtlasSecurityConfig.java
index 6121c3548..52739fb48 100644
---
a/server-common/src/main/java/org/apache/atlas/server/common/security/AtlasSecurityConfig.java
+++
b/server-common/src/main/java/org/apache/atlas/server/common/security/AtlasSecurityConfig.java
@@ -128,7 +128,8 @@ public abstract class AtlasSecurityConfig extends
WebSecurityConfigurerAdapter {
httpSecurity
.authorizeRequests().anyRequest().authenticated()
.and()
- .headers()
+ // Why disable() xssProtection -> By default Spring Security
automatically adds security headers unless you disable them. No Modern Browsers
support and its replaced by "Content-Security-Policy"
+ .headers().xssProtection().disable()
.addHeaderWriter(new
StaticHeadersWriter(HeadersUtil.CONTENT_SEC_POLICY_KEY,
HeadersUtil.getHeaderMap(HeadersUtil.CONTENT_SEC_POLICY_KEY)))
.addHeaderWriter(new
StaticHeadersWriter(HeadersUtil.SERVER_KEY,
HeadersUtil.getHeaderMap(HeadersUtil.SERVER_KEY)))
.and()
diff --git
a/webapp/src/test/java/org/apache/atlas/web/filters/HeaderUtilsTest.java
b/webapp/src/test/java/org/apache/atlas/web/filters/HeaderUtilsTest.java
index 167c6ca75..2fb4f4947 100644
--- a/webapp/src/test/java/org/apache/atlas/web/filters/HeaderUtilsTest.java
+++ b/webapp/src/test/java/org/apache/atlas/web/filters/HeaderUtilsTest.java
@@ -95,7 +95,6 @@ public class HeaderUtilsTest {
assertEquals("DENY",
HeadersUtil.getHeaderMap(HeadersUtil.X_FRAME_OPTIONS_KEY));
assertEquals("nosniff",
HeadersUtil.getHeaderMap(HeadersUtil.X_CONTENT_TYPE_OPTIONS_KEY));
- assertEquals("1; mode=block",
HeadersUtil.getHeaderMap(HeadersUtil.X_XSS_PROTECTION_KEY));
}
private Properties createPropertiesWithHeaders(String... headers) {
diff --git
a/webapp/src/test/java/org/apache/atlas/web/security/AtlasSecurityConfigTest.java
b/webapp/src/test/java/org/apache/atlas/web/security/AtlasSecurityConfigTest.java
index da7ba5beb..3fbed332b 100644
---
a/webapp/src/test/java/org/apache/atlas/web/security/AtlasSecurityConfigTest.java
+++
b/webapp/src/test/java/org/apache/atlas/web/security/AtlasSecurityConfigTest.java
@@ -496,6 +496,7 @@ public class AtlasSecurityConfigTest {
ExpressionUrlAuthorizationConfigurer<HttpSecurity>.ExpressionInterceptUrlRegistry
mockAuthRequests =
mock(ExpressionUrlAuthorizationConfigurer.ExpressionInterceptUrlRegistry.class);
ExpressionUrlAuthorizationConfigurer<HttpSecurity>.AuthorizedUrl
mockAuthorizedUrl =
mock(ExpressionUrlAuthorizationConfigurer.AuthorizedUrl.class);
HeadersConfigurer<HttpSecurity> mockHeadersConfigurer =
mock(HeadersConfigurer.class);
+ HeadersConfigurer<HttpSecurity>.XXssConfig mockXssConfigurer =
mock(HeadersConfigurer.XXssConfig.class);
ServletApiConfigurer<HttpSecurity> mockServletApiConfigurer =
mock(ServletApiConfigurer.class);
CsrfConfigurer<HttpSecurity> mockCsrfConfigurer =
mock(CsrfConfigurer.class);
SessionManagementConfigurer<HttpSecurity> mockSessionConfigurer =
mock(SessionManagementConfigurer.class);
@@ -511,6 +512,8 @@ public class AtlasSecurityConfigTest {
when(mockAuthRequests.and()).thenReturn(httpSecurity);
when(httpSecurity.headers()).thenReturn(mockHeadersConfigurer);
+
when(mockHeadersConfigurer.xssProtection()).thenReturn(mockXssConfigurer);
+ when(mockXssConfigurer.disable()).thenReturn(mockHeadersConfigurer);
when(mockHeadersConfigurer.addHeaderWriter(any(StaticHeadersWriter.class))).thenReturn(mockHeadersConfigurer);
when(mockHeadersConfigurer.and()).thenReturn(httpSecurity);
@@ -836,6 +839,7 @@ public class AtlasSecurityConfigTest {
ExpressionUrlAuthorizationConfigurer<HttpSecurity>.ExpressionInterceptUrlRegistry
mockAuthRequests =
mock(ExpressionUrlAuthorizationConfigurer.ExpressionInterceptUrlRegistry.class);
ExpressionUrlAuthorizationConfigurer<HttpSecurity>.AuthorizedUrl
mockAuthorizedUrl =
mock(ExpressionUrlAuthorizationConfigurer.AuthorizedUrl.class);
HeadersConfigurer<HttpSecurity> mockHeadersConfigurer =
mock(HeadersConfigurer.class);
+ HeadersConfigurer<HttpSecurity>.XXssConfig mockXssConfigurer =
mock(HeadersConfigurer.XXssConfig.class);
ServletApiConfigurer<HttpSecurity> mockServletApiConfigurer =
mock(ServletApiConfigurer.class);
CsrfConfigurer<HttpSecurity> mockCsrfConfigurer =
mock(CsrfConfigurer.class);
SessionManagementConfigurer<HttpSecurity> mockSessionConfigurer =
mock(SessionManagementConfigurer.class);
@@ -851,6 +855,8 @@ public class AtlasSecurityConfigTest {
when(mockAuthRequests.and()).thenReturn(mockHttpSecurity);
when(mockHttpSecurity.headers()).thenReturn(mockHeadersConfigurer);
+
when(mockHeadersConfigurer.xssProtection()).thenReturn(mockXssConfigurer);
+ when(mockXssConfigurer.disable()).thenReturn(mockHeadersConfigurer);
when(mockHeadersConfigurer.addHeaderWriter(any(StaticHeadersWriter.class))).thenReturn(mockHeadersConfigurer);
when(mockHeadersConfigurer.and()).thenReturn(mockHttpSecurity);
