It would be great to have instructions or link about Spring configuration.
Here is an instruction: https://docs.spring.io/spring-security/site/docs/4.2.x/reference/html/headers.html#headers-csp and mention that with Spring Boot it's possible to use security.headers.* properties.