java.lang.Object
net.i2p.i2ptunnel.SecurityHeaderBuilder
public class SecurityHeaderBuilderextends Object
Builds and manages HTTP security headers for server responses.

This class provides static methods for adding security-related HTTP headers to server responses. It handles:

  • Referrer-Policy header
  • Allow header
  • Cache-Control header with appropriate policies
  • X-XSS-Protection header
  • X-Content-Type-Options header

Some headers are only added based on the MIME type of the response content. For example, Referrer-Policy and Allow headers are only added for HTML content. Cache-Control policies vary based on whether the content is static (immutable) or dynamic.

  • Field Details

  • Constructor Details

    • SecurityHeaderBuilder

      public SecurityHeaderBuilder()
      Every add* method is static and the only field is the cookie filter list, so an instance carries nothing.

  • Method Details

    • addSecurityHeaders

      public static void addSecurityHeaders(Map<String, List<String>> headers, String mimeType)
      Adds all appropriate security headers to a response.

      This method adds security headers based on the MIME type of the response. Headers are only added if they are not already present in the response.

      The following headers may be added:

      • Referrer-Policy: same-origin (for HTML/XML/JSON content)
      • Allow: GET, POST, HEAD (for HTML/XML/JSON content)
      • Cache-Control (appropriate policy based on MIME type)
      • X-XSS-Protection: 1; mode=block
      • X-Content-Type-Options: nosniff
      Parameters:
      headers - the HTTP response headers map to modify
      mimeType - the MIME type of the response content; may be null

    • addReferrerPolicyHeader

      private static void addReferrerPolicyHeader(Map<String, List<String>> headers, String mimeType)
      Adds Referrer-Policy header if appropriate and not already present.

      The Referrer-Policy header is only added for MIME types in the custom whitelist (text/html, application/xhtml+xml, application/xml, text/plain, application/json).

      Sets: Referrer-Policy: same-origin.

      Parameters:
      headers - the HTTP response headers map
      mimeType - the response MIME type

    • addAllowHeader

      private static void addAllowHeader(Map<String, List<String>> headers, String mimeType)
      Adds Allow header if appropriate and not already present.

      The Allow header is only added for MIME types in the custom whitelist.

      Sets: Allow: GET, POST, HEAD.

      Parameters:
      headers - the HTTP response headers map
      mimeType - the response MIME type

    • addCacheControlHeader

      private static void addCacheControlHeader(Map<String, List<String>> headers, String mimeType)
      Adds or modifies Cache-Control header based on MIME type.

      Cache-Control policy is determined as follows:

      • For immutable content (images, fonts, video, audio): Cache-Control: private, max-age=31536000, immutable
      • For other content: Cache-Control: private, no-cache, max-age=604800
      • Existing Cache-Control headers are preserved unless they contain "none" or "post-check" which are stripped

      If an existing Cache-Control contains "no-cache" and the content is immutable, it is upgraded to immutable caching.

      Parameters:
      headers - the HTTP response headers map
      mimeType - the response MIME type

    • addXSSProtectionHeader

      private static void addXSSProtectionHeader(Map<String, List<String>> headers)
      Adds X-XSS-Protection header if not already present.

      Sets: X-XSS-Protection: 1; mode=block

      This header enables the XSS filter in browsers that support it.

      Parameters:
      headers - the HTTP response headers map

    • addNoSniffHeader

      private static void addNoSniffHeader(Map<String, List<String>> headers)
      Adds X-Content-Type-Options header if not already present.

      Sets: X-Content-Type-Options: nosniff

      This header prevents browsers from MIME-sniffing a response away from the declared content-type.

      Parameters:
      headers - the HTTP response headers map

    • filterSetCookieHeaders

      public static void filterSetCookieHeaders(Map<String, List<String>> headers)
      Filters Set-Cookie headers to remove unwanted cookies.

      This method removes Set-Cookie headers containing specific strings (STYXKEY, visited=yes) that are known to be irrelevant or unwanted for I2P HTTP proxying.

      Parameters:
      headers - the HTTP response headers map

    • filterCacheControlHeaders

      public static void filterCacheControlHeaders(Map<String, List<String>> headers)
      Filters Cache-Control headers to remove problematic values.

      This method removes "none" and "post-check" values from Cache-Control headers, as these can cause issues with I2P HTTP proxying.

      Parameters:
      headers - the HTTP response headers map