diff --git a/config/src/main/java/org/springframework/security/config/annotation/web/configurers/HeadersConfigurer.java b/config/src/main/java/org/springframework/security/config/annotation/web/configurers/HeadersConfigurer.java index 10986daef59..1a95dbffddb 100644 --- a/config/src/main/java/org/springframework/security/config/annotation/web/configurers/HeadersConfigurer.java +++ b/config/src/main/java/org/springframework/security/config/annotation/web/configurers/HeadersConfigurer.java @@ -75,6 +75,7 @@ * @author Vedran Pavic * @author Ankur Pathak * @author Daniel Garnier-Moiroux + * @author Andrey Litvitski * @since 3.2 */ public class HeadersConfigurer> @@ -355,19 +356,40 @@ public HeadersConfigurer referrerPolicy(Customizer refe * @return the {@link FeaturePolicyConfig} for additional configuration * @throws IllegalArgumentException if policyDirectives is {@code null} or empty * @since 5.1 - * @deprecated For removal in 7.0. Use {@link #permissionsPolicy(Customizer)} or - * {@code permissionsPolicy(Customizer.withDefaults())} to stick with defaults. See - * the documentation - * for more details. * @see ObjectPostProcessorConfiguration FeaturePolicyHeaderWriter */ - @Deprecated public FeaturePolicyConfig featurePolicy(String policyDirectives) { this.featurePolicy.writer = new FeaturePolicyHeaderWriter(policyDirectives); return this.featurePolicy; } + /** + * Allows configuration for Feature + * Policy using the lambda-based DSL. + *

+ * Calling this method automatically enables (includes) the {@code Feature-Policy} + * header in the response using the supplied policy directive(s). + *

+ * Configuration is provided to the {@link FeaturePolicyHeaderWriter}, which is + * responsible for writing the header. + *

+ * Even though the Feature-Policy header has been deprecated in favor of the + * Permissions-Policy header, many browsers still support Feature-Policy. As such, + * this method allows applications to continue using Feature-Policy when necessary. + * @param featurePolicyCustomizer the {@link Customizer} to provide feature policy + * configuration + * @return the {@link HeadersConfigurer} for additional configuration + * @since 6.5 + * @see FeaturePolicyHeaderWriter + * @see Feature Policy + * specification + */ + public HeadersConfigurer featurePolicy(Customizer featurePolicyCustomizer) { + this.featurePolicy.writer = new FeaturePolicyHeaderWriter(); + featurePolicyCustomizer.customize(this.featurePolicy); + return this; + } + /** * Allows configuration for * Permissions @@ -990,6 +1012,17 @@ public final class FeaturePolicyConfig { private FeaturePolicyConfig() { } + /** + * Sets the policy directives to be used in the response header. + * @param policyDirectives a permissions policy directives + * @return the {@link FeaturePolicyConfig} for additional configuration + * @throws IllegalArgumentException if policy is null + */ + public FeaturePolicyConfig policyDirectives(String policyDirectives) { + this.writer.setPolicyDirectives(policyDirectives); + return this; + } + /** * Allows completing configuration of Feature Policy and continuing configuration * of headers. diff --git a/config/src/main/java/org/springframework/security/config/web/server/ServerHttpSecurity.java b/config/src/main/java/org/springframework/security/config/web/server/ServerHttpSecurity.java index a46e7841b3e..439e7e474f3 100644 --- a/config/src/main/java/org/springframework/security/config/web/server/ServerHttpSecurity.java +++ b/config/src/main/java/org/springframework/security/config/web/server/ServerHttpSecurity.java @@ -297,6 +297,7 @@ * @author Ankur Pathak * @author Alexey Nesterov * @author Yanming Zhou + * @author Andrey Litvitski * @since 5.0 */ public class ServerHttpSecurity { @@ -2584,14 +2585,22 @@ public HeaderSpec contentSecurityPolicy(Customizer co * Configures {@code Feature-Policy} response header. * @param policyDirectives the policy * @return the {@link FeaturePolicySpec} to configure - * @deprecated For removal in 7.0. Use {@link #permissionsPolicy(Customizer)} - * instead. */ - @Deprecated public FeaturePolicySpec featurePolicy(String policyDirectives) { return new FeaturePolicySpec(policyDirectives); } + /** + * Configures {@code Feature-Policy} response header. + * @param featurePolicyCustomizer the {@link Customizer} to provide more options + * for the {@link FeaturePolicySpec} + * @return the {@link HeaderSpec} to customize + */ + public HeaderSpec featurePolicy(Customizer featurePolicyCustomizer) { + featurePolicyCustomizer.customize(new FeaturePolicySpec()); + return this; + } + /** * Configures {@code Permissions-Policy} response header. * @param permissionsPolicyCustomizer the {@link Customizer} to provide more @@ -2872,6 +2881,9 @@ private ContentSecurityPolicySpec(String policyDirectives) { */ public final class FeaturePolicySpec { + private FeaturePolicySpec() { + } + private FeaturePolicySpec(String policyDirectives) { HeaderSpec.this.featurePolicy.setPolicyDirectives(policyDirectives); } diff --git a/config/src/main/kotlin/org/springframework/security/config/annotation/web/HeadersDsl.kt b/config/src/main/kotlin/org/springframework/security/config/annotation/web/HeadersDsl.kt index 0fb20823a4a..32fb702bfae 100644 --- a/config/src/main/kotlin/org/springframework/security/config/annotation/web/HeadersDsl.kt +++ b/config/src/main/kotlin/org/springframework/security/config/annotation/web/HeadersDsl.kt @@ -166,7 +166,6 @@ class HeadersDsl { * * @param policyDirectives policyDirectives the security policy directive(s) */ - @Deprecated("Use 'permissionsPolicy { }' instead.") fun featurePolicy(policyDirectives: String) { this.featurePolicyDirectives = policyDirectives } diff --git a/web/src/main/java/org/springframework/security/web/header/writers/FeaturePolicyHeaderWriter.java b/web/src/main/java/org/springframework/security/web/header/writers/FeaturePolicyHeaderWriter.java index fe8c891eee4..d4d9d2d045f 100644 --- a/web/src/main/java/org/springframework/security/web/header/writers/FeaturePolicyHeaderWriter.java +++ b/web/src/main/java/org/springframework/security/web/header/writers/FeaturePolicyHeaderWriter.java @@ -42,6 +42,12 @@ public final class FeaturePolicyHeaderWriter implements HeaderWriter { private String policyDirectives; + /** + * Create a new instance of {@link FeaturePolicyHeaderWriter} + */ + public FeaturePolicyHeaderWriter() { + } + /** * Create a new instance of {@link FeaturePolicyHeaderWriter} with supplied security * policy directive(s).