OTR:AKR(Backend): Security audit fixes. Added cache no-store and CSP …

…policy
Opetushallitus · Jan 31, 2025 · e256106 · e256106
1 parent ca6cd98
commit e256106
Show file tree

Hide file tree

Showing 3 changed files with 11 additions and 0 deletions.
diff --git a/backend/akr/src/main/java/fi/oph/akr/api/clerk/StatisticsController.java b/backend/akr/src/main/java/fi/oph/akr/api/clerk/StatisticsController.java
@@ -127,6 +127,7 @@ public void getEmailStatisticsByYear(final HttpServletResponse response) throws
   private static void writeHeaders(final HttpServletResponse response, final String filename) {
     response.setContentType(MEDIA_TYPE_XLSX);
     response.addHeader("Content-Disposition", String.format("attachment; filename=\"%s\"", filename));
+    response.setHeader("Cache-Control", "no-cache, no-store, private, max-age=0, must-revalidate");
   }
 
   private void writeContactRequestStatisticsExcel(

diff --git a/backend/akr/src/main/java/fi/oph/akr/config/security/WebSecurityConfig.java b/backend/akr/src/main/java/fi/oph/akr/config/security/WebSecurityConfig.java
@@ -159,6 +159,11 @@ public static HttpSecurity commonConfig(final HttpSecurity httpSecurity) throws
           .permitAll()
           .anyRequest()
           .authenticated()
+      )
+      .headers(httpSecurityHeadersConfigurer ->
+        httpSecurityHeadersConfigurer.contentSecurityPolicy(contentSecurityPolicyConfig ->
+          contentSecurityPolicyConfig.policyDirectives("style-src 'self'; script-src 'self'; form-action 'self'")
+        )
       );
   }
 

diff --git a/backend/otr/src/main/java/fi/oph/otr/config/security/WebSecurityConfig.java b/backend/otr/src/main/java/fi/oph/otr/config/security/WebSecurityConfig.java
@@ -159,6 +159,11 @@ public static HttpSecurity commonConfig(final HttpSecurity httpSecurity) throws
           .permitAll()
           .anyRequest()
           .authenticated()
+      )
+      .headers(httpSecurityHeadersConfigurer ->
+        httpSecurityHeadersConfigurer.contentSecurityPolicy(contentSecurityPolicyConfig ->
+          contentSecurityPolicyConfig.policyDirectives("style-src 'self'; script-src 'self'; form-action 'self'")
+        )
       );
   }