Default Security Headers · Security Headers in Spring Security | Spring Security

Default Security Headers

What You Get for Free

Spring Security adds a set of protective headers to every response without any configuration:

Header	Default value	Protects against
`Cache-Control`, `Pragma`, `Expires`	`no-cache, no-store, max-age=0, must-revalidate`	private pages stored in shared/browser caches
`X-Content-Type-Options`	`nosniff`	browser guessing a file is HTML/JS (MIME sniffing)
`Strict-Transport-Security`	`max-age=31536000 ; includeSubDomains` (HTTPS requests only)	SSL stripping, downgrade to HTTP
`X-Frame-Options`	`DENY`	clickjacking (your page inside an invisible iframe)
`X-XSS-Protection`	`0`	disables the buggy legacy XSS auditor (CSP replaces it)

See Them

Default headers

curl -sI https://localhost:8443/api/orders -H "Authorization: Bearer $TOKEN" -k

Example output

HTTP/1.1 200
X-Content-Type-Options: nosniff
X-XSS-Protection: 0
Cache-Control: no-cache, no-store, max-age=0, must-revalidate
Pragma: no-cache
Expires: 0
Strict-Transport-Security: max-age=31536000 ; includeSubDomains
X-Frame-Options: DENY
Content-Type: application/json

Note: Static assets (product images, JS bundles) should be cached. If Spring serves them, override caching for those paths with spring.web.resources.cache.cachecontrol.max-age=365d — resource handlers set their own Cache-Control, which Spring Security respects.