Tomcat解决Web漏洞Clickjacking: X-Frame-Options header missing

風起青萍

于 2019-04-17 10:03:03 发布

阅读量4k

点赞数

本文链接：https://blog.csdn.net/meicury/article/details/89350155

版权

Tomcat解决Web漏洞Clickjacking: X-Frame-Options header missing

在tomcat的conf目录下的web.xml配置中增加以下配置

	<filter>
		<filter-name>httpHeaderSecurity</filter-name>
		<filter-class>org.apache.catalina.filters.HttpHeaderSecurityFilter</filter-class>
		<init-param>
			<param-name>antiClickJackingEnabled</param-name>
			<param-value>true</param-value>
		</init-param>
		<init-param>
			<param-name>antiClickJackingOption</param-name>
			<param-value>SAMEORIGIN</param-value>
		</init-param>
		<async-supported>true</async-supported>
	</filter>
	<filter-mapping>
		<filter-name>httpHeaderSecurity</filter-name>
		<url-pattern>/*</url-pattern>
	</filter-mapping>