@SuppressWarnings("nls")
    private void setSecurityHeaders(HttpSecurityBean config, HeaderMap headers) {
        if (config.getHsts().getEnabled()) {
            headers.put("Strict-Transport-Security", config.getHsts().getHeaderValue());
        }

        if (config.getFrameOptions() != FrameOptions.DISABLED) {
            headers.put("X-Frame-Options", config.getFrameOptions().toString());
        }

        if (config.getXssProtection() != XssProtection.DISABLED) {
            headers.put("X-XSS-Protection", config.getXssProtection().toString());
        }

        if (config.getContentTypeOptions()) {
            headers.put("X-Content-Type-Options", "nosniff");
        }

        ContentSecurityPolicyBean policyBean = config.getContentSecurityPolicy();

        if (policyBean.getMode() != ContentSecurityPolicyBean.Mode.DISABLED) {

            if (policyBean.getMode() == ContentSecurityPolicyBean.Mode.ENABLED) {
                headers.put("Content-Security-Policy", policyBean.getCsp());
            }

            if (policyBean.getMode() == ContentSecurityPolicyBean.Mode.REPORT_ONLY) {
                headers.put("Content-Security-Policy-Report-Only", policyBean.getCsp());
            }
        }

    }
Security-related HTTP headers can be set, such as HSTS, CSP and XSS protection.

@author Marc Savy {@literal <msavy@redhat.com>}
plugins/http-security-policy/src/main/java/io/apiman/plugins/httpsecuritypolicy/HttpSecurityPolicy.java