bito-code-review[bot] commented on PR #15967:
URL: https://github.com/apache/grails-core/pull/15967#issuecomment-4939946633
<!-- Bito Reply -->
The proposed change to move header application into a `finally` block is
technically sound for ensuring that downstream components have the first
opportunity to set headers. By applying defaults only if the headers are
missing after the filter chain completes, you prevent the filter from
prematurely setting values that might conflict with or override specific
requirements set by controllers or other filters. This approach effectively
balances providing sensible defaults with allowing granular overrides.
**grails-controllers/src/main/groovy/org/grails/plugins/web/controllers/GrailsSecurityHeadersFilter.java**
```
@Override
protected void doFilterInternal(HttpServletRequest request,
HttpServletResponse response, FilterChain filterChain)
throws ServletException, IOException {
try {
filterChain.doFilter(request, response);
} finally {
applyHeader(response, "X-Content-Type-Options",
properties.getContentTypeOptions());
// ... apply other headers
}
}
```
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
