@Override
    public void doFilter(final ServletRequest servletRequest, final ServletResponse servletResponse,
                         final FilterChain filterChain) throws IOException, ServletException {
        if (servletResponse instanceof final HttpServletResponse httpServletResponse) {
            for (val entry : this.headersMap.entrySet()) {
                LOGGER.debug("Adding parameter [{}] with value [{}]", entry.getKey(), entry.getValue());
                httpServletResponse.addHeader(entry.getKey(), entry.getValue());
            }
        }
        filterChain.doFilter(servletRequest, servletResponse);
    }
Allows users to easily inject the default security headers to assist in protecting the application.
The default for is to include the following headers:
&lt;pre&gt;
Cache-Control: no-cache, no-store, max-age=0, must-revalidate
Pragma: no-cache
Expires: 0
X-Content-Type-Options: nosniff
Strict-Transport-Security: max-age=15768000 ; includeSubDomains
X-Frame-Options: DENY
X-XSS-Protection: 1; mode=block
&lt;/pre&gt;

@author Misagh Moayyed
@since 6.1.0
core/cas-server-core-web-api/src/main/java/org/apereo/cas/web/support/filters/AddResponseHeadersFilter.java