XFrameOptionsHeaderWriter with WhiteListedAllowFromStrategy doesn't work.

[indyaah]

I have this JavaConfig set up for spring security (extending WebSecurityConfigurerAdapter and @EnableWebSecurity)

And I add header writer from xframe to http using following.

...
http().addHeaderWriter(new XFrameOptionsHeaderWriter(new WhiteListedAllowFromStrategy(getWhitelistUrls())))
...

    private List<String> getWhitelistUrls(){
        String urls = environment.getProperty("application.whitelist.urls");
        return Arrays.asList(urls.split("\\s*,\\s*"));
    }

Context boots up properly but now when I start using the application, always the header coming in request is DENY so the response goes with the same header as per writeHeaders method in XFrameOptionsHeaderWriter.

Shouldn't my header contain all the ALLOW-FROM : specified by my config?

[jalfonso]

I am also seeing an issue with WhiteListedAllowFromStrategy. If I use this headers() configuration:

.addHeaderWriter(new XFrameOptionsHeaderWriter(new WhiteListedAllowFromStrategy(Arrays.asList("http://example.com"))))

The following response header is generated:

X-Frame-Options:ALLOW-FROM DENY

Using StaticAllowFromStrategy for a single origin works fine:

.addHeaderWriter(new XFrameOptionsHeaderWriter(new StaticAllowFromStrategy(new URI("http://example.com"))))

produces

X-Frame-Options:ALLOW-FROM http://example.com

[indyaah]

Exactly, StaticAllowFromStrategy is not an issue, the problem is occurring with only WhiteListedAllowFromStrategy.

[rwinch]

You need to ensure that you have provided the origin using the x-frames-allow-from parameter and that origin must match one of the whitelisted origins.

[sniederb]

On Spring Boot 1.5.12.RELEASE (configures spring-security 4.2.5.RELEASE), I'm seeing the exact behavior as described by @jalfonso

[schuch]

I am also seeing an issue with WhiteListedAllowFromStrategy. If I use this headers() configuration:

.addHeaderWriter(new XFrameOptionsHeaderWriter(new WhiteListedAllowFromStrategy(Arrays.asList("http://example.com"))))

The following response header is generated:

X-Frame-Options:ALLOW-FROM DENY

Using StaticAllowFromStrategy for a single origin works fine:

.addHeaderWriter(new XFrameOptionsHeaderWriter(new StaticAllowFromStrategy(new URI("http://example.com"))))

produces

X-Frame-Options:ALLOW-FROM http://example.com

The ALLOW FROM DENY issue was fixed with #4559