Careeroza

Real World Example

Where You See This

  • GitHub, Google, PayPal send strict CSP and HSTS-preload headers — look at them in your browser DevTools → Network → Response headers.
  • Payment gateways (Razorpay, PayU) publish the exact CSP entries merchants must allow for their checkout scripts and iframes.
  • Security scanners like securityheaders.com and Mozilla Observatory grade sites (A+ to F) on these headers; many enterprise clients ask for an A grade.

ShopEase Production Headers

@Configuration
public class SecurityHeadersConfig {

    @Bean
    Customizer<HeadersConfigurer<HttpSecurity>> shopEaseHeaders(
            @Value("${shopease.csp.report-only:false}") boolean reportOnly) {
        return headers -> {
            headers.contentSecurityPolicy(csp -> {
                csp.policyDirectives("default-src 'self'; script-src 'self' https://checkout.razorpay.com; "
                        + "img-src 'self' https://cdn.shopease.in data:; connect-src 'self' https://api.razorpay.com; "
                        + "frame-src https://api.razorpay.com; frame-ancestors 'none'; object-src 'none'; base-uri 'self'");
                if (reportOnly) csp.reportOnly();
            });
            headers.httpStrictTransportSecurity(hsts -> hsts.includeSubDomains(true).preload(true)
                    .maxAgeInSeconds(Duration.ofDays(365).toSeconds()));
            headers.referrerPolicy(r -> r.policy(ReferrerPolicyHeaderWriter.ReferrerPolicy.STRICT_ORIGIN_WHEN_CROSS_ORIGIN));
            headers.addHeaderWriter(new StaticHeadersWriter("Permissions-Policy", "camera=(), microphone=(), geolocation=(self)"));
        };
    }
}

// in the SecurityFilterChain bean
http.headers(shopEaseHeaders);

Production response

curl -sI https://shopease.in/account | grep -iE "content-security|strict-transport|referrer|permissions|x-frame|x-content"

Example output

content-security-policy: default-src 'self'; script-src 'self' https://checkout.razorpay.com; img-src 'self' https://cdn.shopease.in data:; connect-src 'self' https://api.razorpay.com; frame-src https://api.razorpay.com; frame-ancestors 'none'; object-src 'none'; base-uri 'self'
strict-transport-security: max-age=31536000 ; includeSubDomains ; preload
referrer-policy: strict-origin-when-cross-origin
permissions-policy: camera=(), microphone=(), geolocation=(self)
x-frame-options: DENY
x-content-type-options: nosniff