spring-security 关闭“禁止iframe调用”

2019独角兽企业重金招聘Python工程师标准>>>

@Configuration
@EnableWebSecurity
//@EnableGlobalMethodSecurity(prePostEnabled=true)//开启@PreAuthorize注解
public class WebSecurityConfig extends WebSecurityConfigurerAdapter {
	
	@Override
    protected void configure(HttpSecurity http) throws Exception {
    	/** 
         * 自定义HeaderWriter，用以覆盖security默认的Header, 
         * 使默认的"X-Frame-Options：DENY"禁止一切iframe调用 
         * 转化为"X-Frame-Options：SAMEORIGIN"允许同域下的iframe调用 
         */  
        HeaderWriter headerWriter = new HeaderWriter() {
            @Override  
            public void writeHeaders(HttpServletRequest request, HttpServletResponse response) {
                response.setHeader("X-Frame-Options","SAMEORIGIN");  
            }  
        };  
        List<HeaderWriter> headerWriters = new ArrayList<>();
        headerWriters.add(headerWriter);  
        HeaderWriterFilter headerWriterFilter = new HeaderWriterFilter(headerWriters);  
        http.addFilter(headerWriterFilter);

    }

}

 

转载于:https://my.oschina.net/u/1189224/blog/866234