jamesfredley opened a new pull request, #15967: URL: https://github.com/apache/grails-core/pull/15967
## Description ### What was found | Problem | Impact | | --- | --- | | Grails apps do not set common security headers by default | Missing X-Content-Type-Options, X-Frame-Options, Referrer-Policy, etc. | | Google Doc 2.1 listed framework default security headers as not covered | No existing open PR for this | | Apps that use Spring Security still benefit from baseline headers when plugin is absent | Framework should provide safe defaults with opt-out | ### What changed | Area | Change | | --- | --- | | Filter | `GrailsSecurityHeadersFilter` (`OncePerRequestFilter`) | | Auto-config | `GrailsSecurityHeadersAutoConfiguration` with `@ConditionalOnMissingBean` | | Defaults | `X-Content-Type-Options: nosniff`, `X-Frame-Options: SAMEORIGIN`, `Referrer-Policy: strict-origin-when-cross-origin`, `X-XSS-Protection: 0` | | HSTS | Only applied on secure requests when configured | | CSP | Disabled by default; set via config when desired | | Config | `grails.security.headers.*` enable/disable and per-header values | | Docs / tests | Security guide, upgrade notes, auto-config specs | ### Out of scope / follow-up | Topic | Status | | --- | --- | | Full CSP policy templates | Follow-up | | Permissions-Policy defaults | Follow-up | | Spring Security header interaction matrix | Document if conflicts appear | ### Related MD topics | Source | Topic | | --- | --- | | Google Doc 2.1 | Default framework security headers | | Status map | Not covered | ## Contributor Checklist ### Issue and Scope - [x] Background explains the security-headers gap. - [x] Scoped to default response headers only. - [x] Single focused feature seed. - [x] Targets `8.0.x`. ### Code Quality - [x] Tests cover enable/disable and defaults. - [x] Focused controllers tests intended for CI. - [x] No mass reformatting. - [x] AI starting point labeled. ### Licensing and Attribution - [x] Apache License 2.0. - [x] Contributor rights confirmed. - [x] `ai-generated-starting-point` label applied. ### Documentation - [x] User-facing docs updated. - [x] PR description explains what changed and why. Assisted-by: Sisyphus:xai/grok-4.5 [gpt-coding] -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
