Provides support for configuring various http headers that are important for web services.

• HTTP Strict Transport Security (HSTS)
• X-Frame-Options
• X-Content-Type-Options
• X-XSS-Protection (XSS)
• Content Security Policy (CSP)
• Cross-Origin Resource Sharing (CORS)
• other custom headers

In your application's Configuration class, add a WebConfiguration object:

public class ExampleConfiguration extends Configuration {
    ...

    @Valid
    @NotNull
    @JsonProperty("web")
    private WebConfiguration webConfiguration = new WebConfiguration();

    public WebConfiguration getWebConfiguration() {
        return webConfiguration;
    }

    public void setWebConfiguration(final WebConfiguration webConfiguration) {
        this.webConfiguration = webConfiguration;
    }
}

Add a WebBundle to the Boostrap object in your initialize method:

bootstrap.addBundle(new WebBundle<>() {
    @Override
    public WebConfiguration getWebConfiguration(final ExampleConfiguration configuration) {
        return configuration.getWebConfiguration();
    }

    // Optional: Override Servlet environment to apply the configuration to the admin servlets
    @Override
    protected ServletEnvironment getServletEnvironment(Environment environment) {
        return environment.admin();
    }
});

Define the following configuration in your config.yml file:

web:
  uriPath: /api
  hsts:
    enabled: true
  frame-options:
    enabled: true
  content-type-options:
    enabled: true
  xss-protection:
    enabled: true

uriPath should indicate the path where APIs are served from.

This minimal config results in the following:

• HSTS configured for 1 year, including sub domains
• Frames disabled
• Content-Type sniffing disabled
• XSS filtering on in block mode

Support for CORS or CSP require additional configuration.

This project is available on Maven Central. To add it to your project simply add the following dependencies to your pom.xml:

<dependency>
  <groupId>io.dropwizard.modules</groupId>
  <artifactId>dropwizard-web</artifactId>
  <version>${dropwizard-web.version}</version>
</dependency>

https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Strict-Transport-Security

web:
  hsts:
    enabled: true
    maxAge: 365 days
    includeSubDomains: true

https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-Frame-Options

web:
  frame-options:
    enabled: true
    option: SAMEORIGIN

https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-Content-Type-Options

web:
  content-type-options:
    enabled: true

https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-XSS-Protection

web:
  xss-protection:
    enabled: true
    on: true
    block: true

• https://developer.mozilla.org/en-US/docs/Web/HTTP/CSP
• https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy
• https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy-Report-Only

web:
  csp:
    enabled: true
    policy: "default-src 'self'"

• https://developer.mozilla.org/en-US/docs/Web/HTTP/CORS
• https://www.eclipse.org/jetty/documentation/9.4.x/cross-origin-filter.html

web:
  cors:
    allowedOrigins: ["example.com"]
    allowedMethods: ["DELETE","GET","HEAD","POST","PUT"]
    allowedHeaders: ["Accept","Authorization","Content-Type","Origin","X-Requested-With"]
    preflightMaxAge: 30 minutes

web:
  headers:
    X-Custom-Header-1: custom value 1
    X-Custom-Header-2: custom value 2

Please file bug reports and feature requests in GitHub issues.