// Adding CSP Header Using Spring Security Java Configuration
@Configuration
public class SpringSecurityConfig extends WebSecurityConfigurerAdapter {
    @Override
    protected void configure(HttpSecurity http) throws Exception {
        // Add CSP headers
        http.headers()
            .contentSecurityPolicy("script-src 'self' https://example.com; object-src https://example.com; report-uri /csp-report-endpoint/");
    }
}

// Adding CSP Header Using Spring Security XML Configuration
<http>
   <!-- ... -->

    <headers>
    <content-security-policy policy-directives="script-src 'self' https://apis.example.com">
        </content-security-policy>
    </headers>
</http>

• Web Penetration Testing in Kali Linux, sayfa 122-127
• https://blog.appcanary.com/2017/http-security-headers.html#hsts
• https://www.tbs-certificates.co.uk/FAQ/en/hsts-iis.html
• https://hstspreload.org/
• https://security.stackexchange.com/questions/64979/mitigating-sslstrip-by-only-serving-a-site-over-https
• http://sectools.org/tool/sslstrip/
• https://www.cyberciti.biz/faq/nginx-send-custom-http-headers/
• https://geekflare.com/tomcat-http-security-header/
• https://docs.spring.io/spring-security/site/docs/current/reference/html/headers.html
• https://spring.io/guides/gs/securing-web/
• https://spring.io/blog/2013/08/23/spring-security-3-2-0-rc1-highlights-security-headers
• https://www.dailyrazor.com/blog/glassfish-vs-tomcat/
• http://www.edu4java.com/en/servlet/servlet1.html