CODEWITHSUNDEEP
tomcat
user6549549
user6549549

Reputation:

How to set x frame option in tomcat

As I found it can be easily set in Apache server: x-frame-options=allow in httpd-conf file

but how about tomcat? I am working with a version 7.0.57

Upvotes: 7

Views: 41524

Answers (3)

Max Yao
Max Yao

Reputation: 731

after tomcat 7.0.63

<filter>
    <filter-name>httpHeaderSecurity</filter-name>
    <filter-class>org.apache.catalina.filters.HttpHeaderSecurityFilter</filter-class>
    <init-param>
        <param-name>antiClickJackingOption</param-name>
        <param-value>SAMEORIGIN</param-value>
    </init-param>
</filter>

For filter-mapping part I have added.

<filter-mapping>
    <filter-name>httpHeaderSecurity</filter-name>
    <url-pattern>/*</url-pattern>
    <dispatcher>REQUEST</dispatcher>
</filter-mapping>

Upvotes: 5

Andrew Lygin
Andrew Lygin

Reputation: 6197

In Tomcat you need to use filters for that:

First, implement your own Filter. Something like this:

public class XFrameHeaderFilter implements Filter {
    public void doFilter(ServletRequest req, ServletResponse resp, FilterChain chain) throws ServletException {
        ((HttpServletResponse) resp).setHeader("x-frame-options", "allow");
        chain.doFilter(req, resp);
    }
}

Second, make this filter a part of your web.xml:

<filter>
  <filter-name>x-frame-header</filter-name>
  <filter-class>XFrameHeaderFilter</filter-class>
</filter>
<filter-mapping>
  <filter-name>x-frame-header</filter-name>
  <url-pattern>/*</url-pattern>
</filter-mapping>

Upvotes: 9

Kevin
Kevin

Reputation: 1363

Tomcat only support a config from 7.0.63 above version.

Upvotes: 0

Related Questions