使用 Spring 引导应用程序启用 HTTP 严格传输安全性 (HSTS)

Question

我已经按照文章 https://docs.spring.io/spring-security/site/docs/4.0.2.RELEASE/reference/html/headers.html#headers-hsts 在我的 Spring 启动应用程序上启用 HSTS 标头。尽管进行了所需的更改，但Strict-Transport-Security标头未显示响应。

POM.xml(依赖关系(

<dependencies>
<dependency>
<groupId>org.springframework.boot</groupId>
<artifactId>spring-boot-starter-web</artifactId>
</dependency>
<dependency>
<groupId>org.springframework.boot</groupId>
<artifactId>spring-boot-starter-actuator</artifactId>
</dependency>
<dependency>
<groupId>org.springframework.boot</groupId>
<artifactId>spring-boot-starter-test</artifactId>
<scope>test</scope>
</dependency>
<dependency>
<groupId>org.springframework.boot</groupId>
<artifactId>spring-boot-starter-thymeleaf</artifactId>
</dependency>
<dependency>
<groupId>org.springframework.security</groupId>
<artifactId>spring-security-web</artifactId>
</dependency>
<dependency>
<groupId>org.springframework.security</groupId>
<artifactId>spring-security-config</artifactId>
</dependency>
</dependencies>

网络安全配置.java

import org.springframework.context.annotation.Configuration;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter;
@EnableWebSecurity
@Configuration
public class WebSecurityConfig extends WebSecurityConfigurerAdapter {
@Override
protected void configure(HttpSecurity http) throws Exception {
http
.headers()
.httpStrictTransportSecurity()
.includeSubDomains(true)
.maxAgeInSeconds(31536000);
}
}

标题列表：

cache-control →no-cache, no-store, max-age=0, must-revalidate
content-language →en-GB
content-type →text/html;charset=UTF-8
date →Thu, 24 May 2018 14:10:29 GMT
expires →0
pragma →no-cache
transfer-encoding →chunked
x-application-context →application:9000
x-content-type-options →nosniff
x-frame-options →SAMEORIGIN
x-xss-protection →1; mode=block

我错过了什么吗？

Answer 1

根据RFC6797，HSTS标头仅注入到HTTPS响应中。

来源： https://docs.spring.io/spring-security/site/docs/4.0.2.RELEASE/reference/htmlsingle/#headers-hsts

Answer 2

它只会在通过HTTPS的第一个请求之后出现。

Answer 3

如其他答案所述，HstsConfig中使用的默认RequestMatcher是检查请求是否为 HTTPS。如果另一个匹配器不适合您，您可以设置另一个匹配器，因为 TLS 未被 Spring 引导终止。

下面的代码确保在所有响应中都设置了Strict-Transport-Security标头：

http.headers()
.httpStrictTransportSecurity()
.requestMatcher(AnyRequestMatcher.INSTANCE)
...