Added changes to headers and cookies for roda 6

roda-ui/roda-wui/src/main/java/org/roda/wui/config/RodaConfig.java

@@ -1,14 +1,19 @@
 package org.roda.wui.config;
 
+import jakarta.servlet.ServletContext;
+import jakarta.servlet.ServletException;
 import org.apereo.cas.client.session.SingleSignOutHttpSessionListener;
 import org.roda.wui.filter.OnOffFilter;
+import org.roda.wui.filter.SecurityHeadersFilter;
 import org.roda.wui.servlets.ContextListener;
 import org.roda.wui.servlets.RodaWuiServlet;
 import org.springframework.beans.factory.annotation.Autowired;
 import org.springframework.beans.factory.config.AutowireCapableBeanFactory;
 import org.springframework.boot.web.servlet.FilterRegistrationBean;
+import org.springframework.boot.web.servlet.ServletContextInitializer;
 import org.springframework.boot.web.servlet.ServletListenerRegistrationBean;
 import org.springframework.boot.web.servlet.ServletRegistrationBean;
+import org.springframework.boot.web.servlet.server.CookieSameSiteSupplier;
 import org.springframework.context.annotation.Bean;
 import org.springframework.context.annotation.Configuration;
 import org.springframework.core.Ordered;
@@ -168,6 +173,34 @@ public FilterRegistrationBean<OnOffFilter> casWebAuthFilter() {
     return registrationBean;
   }
 
+  @Bean
+  public FilterRegistrationBean<SecurityHeadersFilter> securityHeadersFilter() {
+    FilterRegistrationBean<SecurityHeadersFilter> registrationBean = new FilterRegistrationBean<>();
+    registrationBean.setFilter(new SecurityHeadersFilter());
+    registrationBean.addUrlPatterns("/*"); // Apply the filter to all requests
+    return registrationBean;
+  }
+
+  @Bean
+  public ServletContextInitializer servletContextInitializer() {
+    return new ServletContextInitializer() {
+
+      @Override
+      public void onStartup(ServletContext servletContext) throws ServletException {
+        servletContext.getSessionCookieConfig().setSecure(true);
+        servletContext.getSessionCookieConfig().setHttpOnly(true);
+      }
+    };
+  }
+
+  @Configuration(proxyBeanMethods = false)
+  public class SameSiteConfiguration {
+    @Bean
+    public CookieSameSiteSupplier applicationCookieSameSiteSupplier() {
+      return CookieSameSiteSupplier.ofStrict();
+    }
+  }
+
   @Configuration
   public static class DefaultView implements WebMvcConfigurer {
 

roda-ui/roda-wui/src/main/java/org/roda/wui/filter/SecurityHeadersFilter.java

@@ -0,0 +1,40 @@
+package org.roda.wui.filter;
+
+import java.io.IOException;
+
+import jakarta.servlet.Filter;
+import jakarta.servlet.FilterChain;
+import jakarta.servlet.FilterConfig;
+import jakarta.servlet.ServletException;
+import jakarta.servlet.ServletRequest;
+import jakarta.servlet.ServletResponse;
+import jakarta.servlet.http.HttpServletResponse;
+
+public class SecurityHeadersFilter implements Filter {
+
+  @Override
+  public void doFilter(ServletRequest request, ServletResponse response, FilterChain chain)
+    throws IOException, ServletException {
+    HttpServletResponse httpServletResponse = (HttpServletResponse) response;
+
+    httpServletResponse.setHeader("Strict-Transport-Security", "max-age=31536000; includeSubDomains");
+    httpServletResponse.setHeader("Content-Security-Policy",
+      "default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://www.google.com " +
+          "https://www.google-analytics.com https://www.gstatic.com; style-src 'self' 'unsafe-inline'; " +
+          "img-src 'self'; font-src 'self';");
+    httpServletResponse.setHeader("X-Frame-Options", "SAMEORIGIN");
+    httpServletResponse.setHeader("X-Content-Type-Options", "nosniff");
+    httpServletResponse.setHeader("Referrer-Policy", "no-referrer");
+    httpServletResponse.setHeader("Permissions-Policy", "geolocation=(self)");
+
+    chain.doFilter(request, response);
+  }
+
+  @Override
+  public void init(FilterConfig filterConfig) {
+  }
+
+  @Override
+  public void destroy() {
+  }
+}

roda-ui/roda-wui/src/main/resources/config/theme/cookies/cookieconsent.js

@@ -99,10 +99,13 @@
       var exdate = new Date();
       exdate.setDate(exdate.getDate() + expiryDays);
 
+      sameSite = 'Strict'; // Default SameSite value
+
       var cookie = [
         name + '=' + value,
         'expires=' + exdate.toUTCString(),
-        'path=' + path || '/'
+        'path=' + path || '/',
+        'SameSite=' + sameSite // Correctly include SameSite attribute
       ];
 
       if (domain) {