|
| 1 | += Preventing XSS with Spring Security and Thymeleaf |
| 2 | +:source-highlighter: highlight.js |
| 3 | +Rashidi Zin <rashidi@zin.my> |
| 4 | +1.0, May 25, 2023 |
| 5 | +:icons: font |
| 6 | +:source-highlighter: highlight.js |
| 7 | +:url-quickref: https://github.com/rashidi/spring-boot-tutorials/tree/master/web-thymeleaf-xss |
| 8 | + |
| 9 | +Prevent Cross-Site Scripting (XSS) attacks in Spring Boot applications using Spring Security and Thymeleaf. |
| 10 | + |
| 11 | +== Background |
| 12 | + |
| 13 | +https://owasp.org/www-community/attacks/xss/[Cross-Site Scripting (XSS)] is a security vulnerability that allows attackers to inject client-side scripts into web pages viewed by other users. This can lead to various attacks, including stealing session cookies, redirecting users to malicious websites, or performing actions on behalf of the user. |
| 14 | + |
| 15 | +In this tutorial, we will demonstrate how to prevent XSS attacks in a Spring Boot application using Spring Security and Thymeleaf. We will focus on two main approaches: |
| 16 | + |
| 17 | +1. Using Spring Security to add security headers |
| 18 | +2. Leveraging Thymeleaf's automatic HTML escaping |
| 19 | + |
| 20 | +== Security Configuration |
| 21 | + |
| 22 | +The first line of defense against XSS attacks is to configure Spring Security to add appropriate security headers. In our example, we use the following configuration: |
| 23 | + |
| 24 | +[source,java] |
| 25 | +---- |
| 26 | +@Configuration |
| 27 | +@EnableWebSecurity |
| 28 | +class SecurityConfiguration { |
| 29 | +
|
| 30 | + @Bean |
| 31 | + public SecurityFilterChain filterChain(HttpSecurity http) throws Exception { |
| 32 | + return http |
| 33 | + .headers(headers -> headers |
| 34 | + .contentSecurityPolicy(policy -> policy.policyDirectives("default-src 'self'")) |
| 35 | + .xssProtection(xss -> xss.headerValue(ENABLED_MODE_BLOCK)) |
| 36 | + ) |
| 37 | + .build(); |
| 38 | + } |
| 39 | +} |
| 40 | +---- |
| 41 | + |
| 42 | +This configuration adds two important security headers: |
| 43 | + |
| 44 | +1. **Content-Security-Policy**: Restricts the sources from which content can be loaded. In this case, `default-src 'self'` means that the browser should only load resources from the same origin. |
| 45 | + |
| 46 | +2. **X-XSS-Protection**: Enables the browser's built-in XSS filter. The value `1; mode=block` (represented by `ENABLED_MODE_BLOCK`) tells the browser to block the response if a XSS attack is detected. |
| 47 | + |
| 48 | +== Thymeleaf Template |
| 49 | + |
| 50 | +Thymeleaf provides built-in protection against XSS by automatically escaping HTML content. Let's look at our simple greeting template: |
| 51 | + |
| 52 | +[source,html] |
| 53 | +---- |
| 54 | +<!DOCTYPE html> |
| 55 | +<html xmlns:th="http://www.thymeleaf.org"> |
| 56 | +<head> |
| 57 | + <meta http-equiv="Content-Type" content="text/html; charset=UTF-8" /> |
| 58 | + <title>Greeting</title> |
| 59 | +</head> |
| 60 | +<body> |
| 61 | +<p th:id="greet" th:utext="|Hello, ${name}!|"></p> |
| 62 | +</body> |
| 63 | +</html> |
| 64 | +---- |
| 65 | + |
| 66 | +The key part here is the use of `th:utext` attribute. Unlike `th:text` which automatically escapes HTML content, `th:utext` (unescaped text) renders HTML as-is. This means that if a user inputs `<script>alert('XSS')</script>`, it will be executed as code rather than displayed as text. This approach is used when you need to render HTML content, but it requires careful handling of user input to prevent XSS attacks. |
| 67 | + |
| 68 | +== Controller Implementation |
| 69 | + |
| 70 | +Our controller simply takes a name parameter and passes it to the Thymeleaf template: |
| 71 | + |
| 72 | +[source,java] |
| 73 | +---- |
| 74 | +@Controller |
| 75 | +class GreetResource { |
| 76 | +
|
| 77 | + @GetMapping("/greet") |
| 78 | + public String greet(@RequestParam String name, Model model) { |
| 79 | + model.addAttribute("name", name); |
| 80 | +
|
| 81 | + return "greet"; |
| 82 | + } |
| 83 | +} |
| 84 | +---- |
| 85 | + |
| 86 | +== Verifying XSS Protection |
| 87 | + |
| 88 | +We can verify that our XSS protection is working by checking that the appropriate security headers are present in the response: |
| 89 | + |
| 90 | +[source,java] |
| 91 | +---- |
| 92 | +@WebMvcTest(controllers = GreetResource.class, includeFilters = @Filter(classes = EnableWebSecurity.class)) |
| 93 | +class GreetResourceTests { |
| 94 | +
|
| 95 | + @Autowired |
| 96 | + private MockMvcTester mvc; |
| 97 | +
|
| 98 | + @Test |
| 99 | + @DisplayName("Given XSS protection is enabled Then response header should contain information about X-XSS-Protection and Content-Security-Policy") |
| 100 | + void headers() { |
| 101 | + mvc.get() |
| 102 | + .uri("/greet?name={name}", "rashidi") |
| 103 | + .assertThat() |
| 104 | + .matches(status().isOk()) |
| 105 | + .matches(header().string("Content-Security-Policy", "default-src 'self'")) |
| 106 | + .matches(header().string("X-XSS-Protection", "1; mode=block")); |
| 107 | + } |
| 108 | +} |
| 109 | +---- |
| 110 | + |
| 111 | +== Common XSS Vulnerabilities to Avoid |
| 112 | + |
| 113 | +1. **Understanding the risks of `th:utext`**: As demonstrated in our example, the `th:utext` attribute in Thymeleaf renders unescaped HTML, which can lead to XSS vulnerabilities if not handled properly. While our example uses `th:utext` for demonstration purposes, in production applications you should use `th:text` instead unless you are absolutely sure the content is safe and HTML rendering is required. |
| 114 | + |
| 115 | +2. **Disabling Content Security Policy**: The Content Security Policy is a powerful defense against XSS. Avoid disabling it or setting overly permissive policies. |
| 116 | + |
| 117 | +3. **Trusting user input**: Always validate and sanitize user input before processing it, even if you're using automatic escaping. |
| 118 | + |
| 119 | +== Conclusion |
| 120 | + |
| 121 | +In this tutorial, we've seen how to implement XSS protection in a Spring Boot application using Spring Security and Thymeleaf. We've demonstrated how to add appropriate security headers through Spring Security configuration. We've also shown how Thymeleaf handles HTML content with `th:utext`, while highlighting the potential security implications and when to use the safer `th:text` alternative instead. |
| 122 | + |
| 123 | +Remember that security is a multi-layered approach, and XSS protection is just one aspect of a comprehensive security strategy. Always keep your dependencies up to date and follow security best practices to ensure your application remains secure. |
0 commit comments