{"action":"created","issue":{"url":"https://api.github.com/repos/spring-projects/spring-security/issues/2898","repository_url":"https://api.github.com/repos/spring-projects/spring-security","labels_url":"https://api.github.com/repos/spring-projects/spring-security/issues/2898/labels{/name}","comments_url":"https://api.github.com/repos/spring-projects/spring-security/issues/2898/comments","events_url":"https://api.github.com/repos/spring-projects/spring-security/issues/2898/events","html_url":"https://github.com/spring-projects/spring-security/issues/2898","id":131777817,"number":2898,"title":"SEC-2678: Remove default HSTS header to avoid accidental DoS of HTTP content","user":{"login":"spring-issuemaster","id":16028288,"avatar_url":"https://avatars.githubusercontent.com/u/16028288?v=3","gravatar_id":"","url":"https://api.github.com/users/spring-issuemaster","html_url":"https://github.com/spring-issuemaster","followers_url":"https://api.github.com/users/spring-issuemaster/followers","following_url":"https://api.github.com/users/spring-issuemaster/following{/other_user}","gists_url":"https://api.github.com/users/spring-issuemaster/gists{/gist_id}","starred_url":"https://api.github.com/users/spring-issuemaster/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/spring-issuemaster/subscriptions","organizations_url":"https://api.github.com/users/spring-issuemaster/orgs","repos_url":"https://api.github.com/users/spring-issuemaster/repos","events_url":"https://api.github.com/users/spring-issuemaster/events{/privacy}","received_events_url":"https://api.github.com/users/spring-issuemaster/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/spring-projects/spring-security/labels/Bug","name":"Bug","color":"eeeeee"},{"url":"https://api.github.com/repos/spring-projects/spring-security/labels/Jira","name":"Jira","color":"ededed"},{"url":"https://api.github.com/repos/spring-projects/spring-security/labels/Resolved","name":"Resolved","color":"ededed"},{"url":"https://api.github.com/repos/spring-projects/spring-security/labels/Works%20as%20Designed","name":"Works as Designed","color":"ededed"}],"state":"closed","locked":false,"assignee":{"login":"rwinch","id":362503,"avatar_url":"https://avatars.githubusercontent.com/u/362503?v=3","gravatar_id":"","url":"https://api.github.com/users/rwinch","html_url":"https://github.com/rwinch","followers_url":"https://api.github.com/users/rwinch/followers","following_url":"https://api.github.com/users/rwinch/following{/other_user}","gists_url":"https://api.github.com/users/rwinch/gists{/gist_id}","starred_url":"https://api.github.com/users/rwinch/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/rwinch/subscriptions","organizations_url":"https://api.github.com/users/rwinch/orgs","repos_url":"https://api.github.com/users/rwinch/repos","events_url":"https://api.github.com/users/rwinch/events{/privacy}","received_events_url":"https://api.github.com/users/rwinch/received_events","type":"User","site_admin":false},"assignees":[{"login":"rwinch","id":362503,"avatar_url":"https://avatars.githubusercontent.com/u/362503?v=3","gravatar_id":"","url":"https://api.github.com/users/rwinch","html_url":"https://github.com/rwinch","followers_url":"https://api.github.com/users/rwinch/followers","following_url":"https://api.github.com/users/rwinch/following{/other_user}","gists_url":"https://api.github.com/users/rwinch/gists{/gist_id}","starred_url":"https://api.github.com/users/rwinch/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/rwinch/subscriptions","organizations_url":"https://api.github.com/users/rwinch/orgs","repos_url":"https://api.github.com/users/rwinch/repos","events_url":"https://api.github.com/users/rwinch/events{/privacy}","received_events_url":"https://api.github.com/users/rwinch/received_events","type":"User","site_admin":false}],"milestone":null,"comments":21,"created_at":"2014-07-03T18:34:14Z","updated_at":"2016-10-19T04:08:17Z","closed_at":"2015-09-23T21:29:47Z","body":"[David Eckel](https://jira.spring.io/secure/ViewProfile.jspa?name=dvdckl) (Migrated from [SEC-2678](https://jira.spring.io/browse/SEC-2678?redirect=false)) said:\n\nIt is trivial to cause an outage of HTTP-only (insecure) content for an entire domain it is hosted on if you deploy an application using Spring Security 3.2+ due to the addition of Strict-Transport-Security by default.  It is not intuitive that explicit configuration of security headers is necessary to support HTTP only pages in the same application and in the same domain.\n\nUnlike the other security headers, HSTS affects an entire domain and not just the current URL, and HSTS is cached (currently set to 1 year), making it impossible to restore HTTP functionality for that domain once a browser has been served the HSTS header.  This could be disastrous for domains with HTTP-only pages, far worse than the SSL-stripping vulnerability that HSTS mitigates.  We have had this happen to us, causing requests to our webapps that redirect from HTTPS to HTTP to go into infinite redirect loop after a user visited an unrelated application under the same domain that set HSTS after it upgraded to Spring Security 3.2.\n\nTo avoid this risk, please remove the call to `httpStrictTransportSecurity()` in https://github.com/spring-projects/spring-security/blob/master/config/src/main/java/org/springframework/security/config/annotation/web/configurers/HeadersConfigurer.java#L239 (added by SEC-2116), and update documentation to reflect that this is an opt-in header, not opt-out."},"comment":{"url":"https://api.github.com/repos/spring-projects/spring-security/issues/comments/254705504","html_url":"https://github.com/spring-projects/spring-security/issues/2898#issuecomment-254705504","issue_url":"https://api.github.com/repos/spring-projects/spring-security/issues/2898","id":254705504,"user":{"login":"TinCongHuynh","id":12095346,"avatar_url":"https://avatars.githubusercontent.com/u/12095346?v=3","gravatar_id":"","url":"https://api.github.com/users/TinCongHuynh","html_url":"https://github.com/TinCongHuynh","followers_url":"https://api.github.com/users/TinCongHuynh/followers","following_url":"https://api.github.com/users/TinCongHuynh/following{/other_user}","gists_url":"https://api.github.com/users/TinCongHuynh/gists{/gist_id}","starred_url":"https://api.github.com/users/TinCongHuynh/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/TinCongHuynh/subscriptions","organizations_url":"https://api.github.com/users/TinCongHuynh/orgs","repos_url":"https://api.github.com/users/TinCongHuynh/repos","events_url":"https://api.github.com/users/TinCongHuynh/events{/privacy}","received_events_url":"https://api.github.com/users/TinCongHuynh/received_events","type":"User","site_admin":false},"created_at":"2016-10-19T04:08:17Z","updated_at":"2016-10-19T04:08:17Z","body":"It seems that we could not disable HSTS header in default end point /oauth/token of spring oauth2 with the below source code.\r\n\r\n@EnableWebSecurity\r\npublic class WebSecurityConfig extends WebSecurityConfigurerAdapter {\r\n        @Override\r\n        protected void configure(HttpSecurity http) throws Exception {\r\n            http\r\n            // ...\r\n            .headers()\r\n                .httpStrictTransportSecurity().disable();\r\n        }\r\n}\r\nAnyone can help me ?\r\n"}}
{"actor":{"display_login":"TinCongHuynh"}}