Httpheadersecurity:x-frame-options

Starting with version 8.0.23, Tomcat supports configuring Httpheadersecurityfilter in its own web. XML, which is an optional option that does not turn on the filter by default, and the following configuration items are supported after opening:

  <!--================== Built in Filter definitions ===================== -  <!--A filter that sets various security related HTTP Response headers.  -  <!--This filter supports the following initialization parameters -  <!--(default values is in square brackets): -  <!--                                                                       -  <!--hstsenabled should the HTTP Strict Transport Security -  <!--(HSTS) header is added to the response? See -  <!--RFC 6797 For more information on HSTS. [True] -  <!--                                                                       -  <!--hstsmaxageseconds The Max age value should is used in the -  <!--HSTS header. Negative values would be treated -  <!--As Zero. [0] -  <!--                                                                       -  <!--Hstsincludesubdomains -  <!--should the Includesubdomains parameter be -  <!--included in the HSTS header.  -  <!--                                                                       -  <!--anticlickjackingenabled -  <!--should the anti click-jacking header -  <!--X-frame-options is added to every response?  -  <!--[True] -  <!--                                                                       -  <!--anticlickjackingoption -  <!--What value should is used for the header. Must -  <!--Be one of DENY, Sameorigin, Allow-from -  <!--(case-insensitive). [DENY] -  <!--                                                                       -  <!--Anticlickjackinguri IF Allow-from is used, what URI should be -  <!--allowed? []                                     -  <!--                                                                       -  <!--blockcontenttypesniffingenabled -  <!--should the header that blocks content type -  <!--sniffing is added to every response? [True] -<!--<filter> <filter-name>httpHeaderSecurity</filter-name> <filter-class>org.apa Che.catalina.filters.httpheadersecurityfilter</filter-class> <async-supported>true</ Async-supported> </filter> -

If you can set a configuration entry that allows only same-origin requests, the following:

<Filter>        <Filter-name>Httpheadersecurity</Filter-name>        <Filter-class>Org.apache.catalina.filters.HttpHeaderSecurityFilter</Filter-class>        <Init-param>            <Param-name>Anticlickjackingoption</Param-name>            <Param-value>Sameorigin</Param-value>        </Init-param>        <async-supported>True</async-supported>    </Filter>        <filter-mapping>        <Filter-name>Httpheadersecurity</Filter-name>        <Url-pattern>/*</Url-pattern>    </filter-mapping>

Also, it is important to note that there are similar configuration items in spring security, and if you use the Spring security framework, you should be aware that the framework defaults to X-frame-options:deny

As shown in the following:

From Official document description (4.0.1)

Tomcat's Httpheadersecurityfilter configuration item overrides the spring security configuration.

Httpheadersecurity:x-frame-options