HTTP Security

@Component
@WebFilter(urlPatterns = {"/*"})
public class ResponseHeaderWebFilter implements Filter {

    @Override
    public void doFilter(
            ServletRequest request,
            ServletResponse response, FilterChain chain
    ) throws IOException, ServletException {
        HttpServletResponse httpServletResponse = (HttpServletResponse) response;
        httpServletResponse.setHeader("Content-Security-Policy", "default-src 'self' 'unsafe-inline' 'unsafe-eval' data: blob:;");
        httpServletResponse.setHeader("Strict-Transport-Security", "max-age=31536000 ; includeSubDomains ; preload");
        httpServletResponse.setHeader("Permissions-Policy", "geolocation 'self'; payment 'none'");
        httpServletResponse.setHeader("X-Content-Type-Options", "nosniff");
        httpServletResponse.setHeader("Referrer-Policy", "strict-origin-when-cross-origin");
        httpServletResponse.setHeader("X-Frame-Options", "DENY");
        chain.doFilter(request, response);
    }
}

References

Content Security Policy Reference Permissions-Policy
Homebrew ZA Proxy JConsole Cypress HTTPie JQ Tool Locust JMeter Wrk