Spring security: allow a few pages to be displayed in iframe

user_997474 0
Viewed 31

I support a website that uses Spring Security (5.3.3.RELEASE). The site can't be displayed in iframe in other sites because of the following configuration

<security:headers>
  <security:frame-options policy="SAMEORIGIN"/>
</security:headers>

Now I am asked to allow a few pages to be displayed in iframe in ANY other sites (not a specific list of sites). I looked at the Spring documentation, and it appears that I can add a bean in the following way:

<security:headers>
  <security:frame-options policy="SAMEORIGIN" ref="bean_id"/>
</security:headers>

I am not able to find info about what interface or methods the bean (bean_id) must implement or whether it can be used to decide what pages are frameable. Any help or example is really appreciated.

spring-security spring-mvc
1 Answers

The interface is of type AllowFromStrategy. But that interface is deprecated since the ALLOW-FROM is an obsolete directive that no longer works in modern browsers, see here. The alternative is to use CSP: frame-ancestors.

Spring Security has support for the Content-Security-Policy header. You can rely on the DelegatingRequestMatcherHeaderWriter implementation to add the headers only to specific pages, like so:

<http>
    <!-- ... -->

    <headers>
        <header ref="headerWriter"/>
    </headers>
</http>

<beans:bean id="headerWriter"
    class="org.springframework.security.web.header.writers.DelegatingRequestMatcherHeaderWriter">
    <beans:constructor-arg>
        <bean class="org.springframework.security.web.util.matcher.AntPathRequestMatcher"
            c:pattern="/page-with-csp"/>
    </beans:constructor-arg>
    <beans:constructor-arg>
        <beans:bean
            class="org.springframework.security.web.header.writers.ContentSecurityPolicyHeaderWriter"/>
    </beans:constructor-arg>
</beans:bean>
user_54548420
Related