Question

在我的网络应用程序中，我使用owasp ZED工具来检查安全漏洞。我发现没有设置X-Content-Type-Options和Content-Type标头。

在我的交叉过滤器中，我在HTTPResponse对象中添加了标题

 @WebFilter("/*")
public class CrossFilter implements Filter {

    private static CoreLogger logger=LoggerFactory.getLogger(FirstServlet.class);

    @Override
    public void doFilter(ServletRequest servletRequest, ServletResponse servletResponse, FilterChain filter) throws IOException,
            ServletException {
        try{
            HttpServletResponse httpServletResponse = (HttpServletResponse ) servletResponse ;
            httpServletResponse.setHeader("Access-Control-Allow-Origin", "*");

            httpServletResponse.setHeader("Access-Control-Allow-Headers", "origin, content-type, accept, authorization");

            httpServletResponse.setHeader("Access-Control-Allow-Credentials", "true");

            httpServletResponse.setHeader("Access-Control-Allow-Methods", "GET, POST, PUT, DELETE, OPTIONS, HEAD");

            httpServletResponse.setHeader("Access-Control-Max-Age", "1209600");

            httpServletResponse.setHeader("X-Frame-Options", "SAMEORIGIN");

            httpServletResponse.setHeader("X-XSS-Protection", "1; mode=block");

            httpServletResponse.setHeader("X-Content-Type-Options", "nosniff");

            httpServletResponse.setHeader("Content-Type", "text/plain");

            filter.doFilter(servletRequest, servletResponse);
        }catch(Exception exc){
            logger.info(exc.getMessage());
            if(logger.isDebugEnabled()){
                logger.error(exc.getMessage(),exc);
            }
        }
    }

现在，当我尝试通过浏览器访问应用程序时，它会向我显示HTML的来源。我以为我添加了text / plain是错的，我尝试了text / html，但仍然存在错误。

如果我做的方式错了，有人可以帮助我吗？

X-Content-Type-Options和Content-Type Headers，不能协同工作

0 个答案: