/*
 *  Copyright (c) 2020, WSO2 Inc. (http://www.wso2.org) All Rights Reserved.
 *
 *  Licensed under the Apache License, Version 2.0 (the "License");
 *  you may not use this file except in compliance with the License.
 *  You may obtain a copy of the License at
 *
 *  http://www.apache.org/licenses/LICENSE-2.0
 *
 *  Unless required by applicable law or agreed to in writing, software
 *  distributed under the License is distributed on an "AS IS" BASIS,
 *  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 *  See the License for the specific language governing permissions and
 *  limitations under the License.
 *
 */

package org.wso2.carbon.apimgt.rest.api.util.interceptors.response;

import org.apache.cxf.interceptor.Fault;
import org.apache.cxf.jaxrs.impl.MetadataMap;
import org.apache.cxf.message.Message;
import org.apache.cxf.phase.AbstractPhaseInterceptor;
import org.apache.cxf.phase.Phase;

import javax.ws.rs.core.MultivaluedMap;

public class ResponseOutInterceptor extends AbstractPhaseInterceptor<Message> {
    private static final String X_CONTENT_TYPE_OPTIONS = "X-Content-Type-Options";
    private static final String X_XSS_PROTECTION = "X-XSS-Protection";

    public ResponseOutInterceptor() {
        super(Phase.PRE_PROTOCOL);
    }

    @Override
    public void handleMessage(Message message) throws Fault {
        MultivaluedMap<String, Object> headers = (MetadataMap<String, Object>) message.get(Message.PROTOCOL_HEADERS);
        if (headers == null) {
            headers = new MetadataMap<>();
        }
        setOutBoundHeaders(message, headers);
    }

    private void setOutBoundHeaders(Message message, MultivaluedMap<String, Object> headers) {
        headers.add(X_CONTENT_TYPE_OPTIONS, "nosniff");
        headers.add(X_XSS_PROTECTION, "1; mode=block");
        message.put(Message.PROTOCOL_HEADERS, headers);
    }
}

@@ -970,16 +970,112 @@
 edMap;%0A%0A
+/**%0A * This class adds security headers to prevent content sniffing and protect against XSS%0A */%0A
 public c
@@ -1299,16 +1299,147 @@
 ection%22;
+%0A    private static final String NO_SNIFF = %22nosniff%22;%0A    private static final String XSS_PROTECTION_MODE_BLOCK = %221; mode=block%22;
 %0A%0A    pu
@@ -1982,25 +1982,24 @@
 PTIONS, 
-%22nosniff%22
+NO_SNIFF
 );%0A     
@@ -2031,31 +2031,41 @@
 ECTION, 
-%221; mode=block%22
+XSS_PROTECTION_MODE_BLOCK
 );%0A     

Add class-level comment