Merge pull request SORMAS-Foundation#3118 from hzi-braunschweig/feature-2991-SecurityHeaders

Feature 2991 security headers

Author: Martin Wahnschaffe

sormas-api/src/main/java/de/symeda/sormas/api/ResourceBundle.java

@@ -1,7 +1,5 @@
 package de.symeda.sormas.api;
 
-import org.apache.commons.text.StringEscapeUtils;
-
 public class ResourceBundle {
 
 	private java.util.ResourceBundle resourceBundle;

sormas-ui/src/main/java/de/symeda/sormas/ui/SessionFilter.java

@@ -28,6 +28,7 @@
 import javax.servlet.ServletResponse;
 import javax.servlet.annotation.WebFilter;
 import javax.servlet.http.HttpServletRequest;
+import javax.servlet.http.HttpServletResponse;
 import javax.servlet.http.HttpSession;
 
 import de.symeda.sormas.api.FacadeProvider;
@@ -66,6 +67,11 @@ public void doFilter(ServletRequest request, ServletResponse response, FilterCha
 		I18nProperties.setUserLanguage(userLanguage);
 		BaseControllerProvider.requestStart(controllerProvider);
 
+		final HttpServletResponse res = (HttpServletResponse)response;
+		res.addHeader("X-Content-Type-Options", "nosniff" );
+		res.addHeader("X-Frame-Options", "SAMEORIGIN" );
+		res.addHeader("Referrer-Policy", "same-origin" );
+
 		try {
 			sessionFilterBean.doFilter(chain, request, response);
 		} finally {