Security Headers for Spring Boot REST APIs – OWASP Guide

Direct Answer

Choose response headers from what the endpoint serves. Spring Security commonly adds X-Content-Type-Options: nosniff, X-Frame-Options: DENY, cache-control headers, and X-XSS-Protection: 0; it adds HSTS only on HTTPS responses. CSP and frame controls mainly protect browser-rendered documents and must match the frontend. A JSON API should send the correct content type and nosniff, protect sensitive caching, and configure CORS only for the origins and credential model it intentionally supports. CORS is a browser read policy, not authentication.

Code Example

@Bean
SecurityFilterChain security(HttpSecurity http) throws Exception {
    http.headers(headers -> headers
        .contentTypeOptions(Customizer.withDefaults())
        .frameOptions(frame -> frame.deny())
        .httpStrictTransportSecurity(hsts -> hsts
            .maxAgeInSeconds(31_536_000)
            .includeSubDomains(false)));

    http.cors(cors -> cors.configurationSource(corsConfigurationSource()));
    return http.build();
}

@Bean
CorsConfigurationSource corsConfigurationSource() {
    CorsConfiguration c = new CorsConfiguration();
    c.setAllowedOrigins(List.of("https://app.example"));
    c.setAllowedMethods(List.of("GET", "POST", "PUT", "DELETE"));
    c.setAllowedHeaders(List.of("Authorization", "Content-Type", "X-CSRF-TOKEN"));
    UrlBasedCorsConfigurationSource source = new UrlBasedCorsConfigurationSource();
    source.registerCorsConfiguration("/api/**", c);
    return source;
}

Add CSP only to responses that render documents, and build it from the page's real script/style needs. Enable HSTS subdomains or preload only after every affected host supports HTTPS.

Common Mistakes & Pitfalls

• Disabling all headers to fix CORS errors: Freshers often disable security headers entirely when they encounter CORS issues, thinking headers are the problem. The real fix is configuring the CORS bean properly—never remove protective headers.
• Using wildcard CORS in production: Setting allowedOrigins to asterisk allows any website to call your API. Always whitelist specific frontend domains like https://yourdomain.com in production environments.
• Not understanding default behavior: Many freshers manually configure headers that Spring Security already adds, creating duplicate or conflicting settings. Check what's automatic first using browser DevTools Network tab to see response headers.