security - Setting HTTP headers in a Play! framework web application -

where can set security http headers in play! framework web application project? want set headers x-content-type-options nosniff , x-frame-options deny.

i have tried set these headers in nginx.conf file, not working zap tool zap tool giving alert these headers missing after setting file.

link: https://github.com/playframework/playframework/pull/2524

i have tried solution in documentation on configuring security headers class securityheadersfilter not present in package said.

i using play! 2.2.1 , java used controllers.

probably best place nginx if you're using reverse proxy play app. instead of adding headers in nginx configuration's http section (as per your comment) try adding in server block.

server {         listen 80;         server_name *.something.com;          location /stuff {                 alias ../;                  add_header x-frame-options deny;                  add_header x-xss-protection "1; mode=block";                  add_header x-content-type-options nosniff;                  add_header x-content-security-policy "default-src 'self'; script-src 'self' ssl.google-analytics.com; img-src 'self' ssl.google-analytics.com";         }         ... } 

results in headers being correctly set:

using owasp zap tool can verify header set correctly. x-frame-options header not set:

when x-frame-options header is set: