> ## Documentation Index
> Fetch the complete documentation index at: https://notes.kodekloud.com/llms.txt
> Use this file to discover all available pages before exploring further.
# Demo OWASP ZAP Fixing Issue
> This guide walks you through remediating the missing X-Content-Type-Options header in HTTP responses for a Spring Boot application.
In our previous tutorial, we ran an OWASP ZAP scan against a Spring Boot application and published an HTML report via Jenkins. This guide walks you through remediating the missing **X-Content-Type-Options** header in HTTP responses.
First, let’s inspect the vulnerability reported by ZAP:
A quick search on [Stack Overflow](https://stackoverflow.com) suggests adding Spring Security Starter to include this header automatically. We’ll:
1. Add the `spring-boot-starter-security` dependency.
2. Create a `WebSecurityConfig` class to disable CSRF (since we’re only using security for headers).
***
## 1. Update pom.xml
Add Spring Security Starter (version managed by your parent POM):
```xml theme={null}
org.springframework.boot
spring-boot-starter-security
```
After insertion, your `` block might resemble:
```xml theme={null}
org.springframework.boot
spring-boot-starter-web
org.springframework.boot
spring-boot-starter-security
org.springdoc
openapi-ui
1.2.30
```
Spring Security automatically adds many secure headers, including `X-Content-Type-Options: nosniff`.
***
## 2. Create WebSecurityConfig
In your IDE, right-click the package under `src/main/java` and select **New → Class**:
Name the class `WebSecurityConfig` and add the following:
```java theme={null}
package com.devsecops;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter;
@EnableWebSecurity
public class WebSecurityConfig extends WebSecurityConfigurerAdapter {
@Override
protected void configure(HttpSecurity http) throws Exception {
http.csrf().disable();
}
}
```
Commit and push your changes (e.g., via GitHub Desktop):
Once pushed, Jenkins will start a new build.
***
## 3. Dependency-Check Failure (CVSS ≥ 8)
During the Maven dependency scan, the build fails due to high-severity issues in Spring Security:
```bash theme={null}
mvn dependency-check:check
...
[ERROR] One or more dependencies were identified with vulnerabilities that have a CVSS score greater than or equal to '8.0':
[ERROR] spring-security-core-5.3.5.RELEASE.jar (CVE-2021-21112)
[ERROR] spring-security-web-5.3.5.RELEASE.jar (CVE-2021-21112)
```
Review the failed build in [Jenkins](https://www.jenkins.io) Build #59:
Verify CVE-2021-21112 on the [NVD](https://nvd.nist.gov):
Since no patched version is available yet, we’ll **temporarily** raise the CVSS threshold to **10**.
Raising the CVSS threshold should only be temporary. Revert once a fixed release is available.
***
## 4. Adjust `failBuildOnCVSS`
In your `pom.xml`, configure the OWASP Dependency-Check plugin:
```xml theme={null}
org.owasp
dependency-check-maven
6.1.6
ALL
10
```
Commit and push again.
***
## 5. Build Passes with CVSS 10
With the threshold raised, the dependency scan now succeeds, and Jenkins shows:
***
## 6. OWASP ZAP DAST
The ZAP stage now completes, reporting only one warning:
```plaintext theme={null}
PASS: X-Content-Type-Options [10021]
...
WARN-NEW: 1 WARN-ING: 1 INFO: 0 IGNORE: 0 PASS: 115
Exit Code: 2
OWASP ZAP Report has either Low/Medium Risk. Please check the HTML Report
```
***
## 7. Verify Response Headers
Refresh your application endpoint in the browser. You should now see:
* **Before:** No `X-Content-Type-Options` header
* **After:** `X-Content-Type-Options: nosniff`
This confirms the header is correctly applied. The only remaining ZAP warning relates to **unexpected Content-Type**, which can be addressed by customizing ZAP’s scan rules.
***
## Links and References
* [OWASP ZAP Official Site](https://www.zaproxy.org)
* [Spring Boot Security Reference](https://docs.spring.io/spring-security/site/docs/current/reference/html5/)
* [OWASP Dependency-Check Maven Plugin](https://jeremylong.github.io/DependencyCheck/dependency-check-maven/)
* [National Vulnerability Database (NVD)](https://nvd.nist.gov)