How to use spring security to prevent xss and xframe attack -

i spring web site , want prevent website form xss , xframe attack

but english not enough figure out set

please guide me else should setting??

i add websecurityconfig.java under src/com/test/web/security

here code :

package com.test.web.security;  import org.springframework.context.annotation.componentscan; import org.springframework.context.annotation.configuration; import org.springframework.security.config.annotation.web.builders.httpsecurity; import org.springframework.security.config.annotation.web.configuration.enablewebsecurity; import org.springframework.security.config.annotation.web.configuration.websecurityconfigureradapter;  @enablewebsecurity @configuration @componentscan public class websecurityconfig extends websecurityconfigureradapter {  @override protected void configure(httpsecurity http) throws exception {  http    // ...    .headers(); } } 

if specify same code have above, spring security should automatically add of relevant security headers. per docs:

if using spring security’s java configuration, of default security headers added default.

also:

as specify headers should included, headers include

see details , code samples in section:

http://docs.spring.io/spring-security/site/docs/3.2.0.release/reference/htmlsingle/#default-security-headers