Fixed: Missing Security and Cache Headers in CMS Events
Instead of having multiple null checks for viewMap separately for each security header we can have a single combined null check at the top in setResponseBrowserDefaultSecurityHeaders() method.
With increasing security headers these may become expensive.
@@ -985,8 +985,11 @@ public final class UtilHttp {
public static void setResponseBrowserDefaultSecurityHeaders(HttpServletResponse resp, ConfigXMLReader.ViewMap viewMap) {
// See https://cwiki.apache.org/confluence/display/OFBIZ/How+to+Secure+HTTP+Headers for details and how to test
String xFrameOption = null;
+ // HTTP Strict-Transport-Security (HSTS) enforces secure (HTTP over SSL/TLS) connections to the server.
+ String strictTransportSecurity = null;
if (viewMap != null) {
xFrameOption = viewMap.xFrameOption;
+ strictTransportSecurity = viewMap.strictTransportSecurity;
}
// Default to sameorigin
if (UtilValidate.isNotEmpty(xFrameOption)) {
@@ -997,12 +1000,6 @@ public final class UtilHttp {
resp.addHeader("x-frame-options", "sameorigin");
}
- // HTTP Strict-Transport-Security (HSTS) enforces secure (HTTP over SSL/TLS) connections to the server.
- String strictTransportSecurity = null;
- if (viewMap != null) {
- strictTransportSecurity = viewMap.strictTransportSecurity;
- }
-
// Default to "max-age=31536000; includeSubDomains" 31536000 secs = 1 year
if (UtilValidate.isNotEmpty(strictTransportSecurity)) {
if (!"none".equals(strictTransportSecurity)) {
