Modifier and Type	Class and Description
private static enum	HttpHeaderSecurityFilter.XFrameOption

Modifier and Type	Field and Description
private static final String	ANTI_CLICK_JACKING_HEADER_NAME
private boolean	antiClickJackingEnabled
private String	antiClickJackingHeaderValue
private HttpHeaderSecurityFilter.XFrameOption	antiClickJackingOption
private URI	antiClickJackingUri
private static final String	BLOCK_CONTENT_TYPE_SNIFFING_HEADER_NAME
private static final String	BLOCK_CONTENT_TYPE_SNIFFING_HEADER_VALUE
private boolean	blockContentTypeSniffingEnabled
private static final String	HSTS_HEADER_NAME
private boolean	hstsEnabled
private String	hstsHeaderValue
private boolean	hstsIncludeSubDomains
private int	hstsMaxAgeSeconds
private boolean	hstsPreload
private final Log	log
private static final String	XSS_PROTECTION_HEADER_NAME Deprecated
private static final String	XSS_PROTECTION_HEADER_VALUE Deprecated
private boolean	xssProtectionEnabled Deprecated

Access	Constructor and Description
public	HttpHeaderSecurityFilter()

Method Summary

Modifier and Type	Method and Description
public void	doFilter(ServletRequest The request to process request, ServletResponse The response associated with the request response, FilterChain Provides access to the next filter in the chain for this filter to pass the request and response to for further processing chain) Implements jakarta.servlet.Filter.doFilter. The `doFilter` method of the Filter is called by the container each time a request/response pair is passed through the chain due to a client request for a resource at the end of the chain.
public String	getAntiClickJackingOption()
public String	getAntiClickJackingUri()
public int	getHstsMaxAgeSeconds()
protected Log	getLogger() Implements abstract org.apache.catalina.filters.FilterBase.getLogger.
public void	init(FilterConfig The configuration information associated with the filter instance being initialised filterConfig) Overrides org.apache.catalina.filters.FilterBase.init. Overrides default jakarta.servlet.Filter.init. Iterates over the configuration parameters and either logs a warning, or throws an exception for any parameter that does not have a matching setter in this filter.
public boolean	isAntiClickJackingEnabled()
public boolean	isBlockContentTypeSniffingEnabled()
protected boolean	isConfigProblemFatal() Overrides org.apache.catalina.filters.FilterBase.isConfigProblemFatal. Determines if an exception when calling a setter or an unknown configuration attribute triggers the failure of the this filter which in turn will prevent the web application from starting.
public boolean	isHstsEnabled()
public boolean	isHstsIncludeSubDomains()
public boolean	isHstsPreload()
public boolean	isXssProtectionEnabled() Deprecated
public void	setAntiClickJackingEnabled(boolean antiClickJackingEnabled)
public void	setAntiClickJackingOption(String antiClickJackingOption)
public void	setAntiClickJackingUri(String antiClickJackingUri)
public void	setBlockContentTypeSniffingEnabled(boolean blockContentTypeSniffingEnabled)
public void	setHstsEnabled(boolean hstsEnabled)
public void	setHstsIncludeSubDomains(boolean hstsIncludeSubDomains)
public void	setHstsMaxAgeSeconds(int hstsMaxAgeSeconds)
public void	setHstsPreload(boolean hstsPreload)
public void	setXssProtectionEnabled(boolean xssProtectionEnabled) Deprecated

Field Detail

ANTI_CLICK_JACKING_HEADER_NAME	back to summary
private static final String ANTI_CLICK_JACKING_HEADER_NAME

antiClickJackingEnabled	back to summary
private boolean antiClickJackingEnabled

antiClickJackingHeaderValue	back to summary
private String antiClickJackingHeaderValue

antiClickJackingOption	back to summary
private HttpHeaderSecurityFilter.XFrameOption antiClickJackingOption

antiClickJackingUri	back to summary
private URI antiClickJackingUri

BLOCK_CONTENT_TYPE_SNIFFING_HEADER_NAME	back to summary
private static final String BLOCK_CONTENT_TYPE_SNIFFING_HEADER_NAME

BLOCK_CONTENT_TYPE_SNIFFING_HEADER_VALUE	back to summary
private static final String BLOCK_CONTENT_TYPE_SNIFFING_HEADER_VALUE

blockContentTypeSniffingEnabled	back to summary
private boolean blockContentTypeSniffingEnabled

HSTS_HEADER_NAME	back to summary
private static final String HSTS_HEADER_NAME

hstsEnabled	back to summary
private boolean hstsEnabled

hstsHeaderValue	back to summary
private String hstsHeaderValue

hstsIncludeSubDomains	back to summary
private boolean hstsIncludeSubDomains

hstsMaxAgeSeconds	back to summary
private int hstsMaxAgeSeconds

hstsPreload	back to summary
private boolean hstsPreload

log	back to summary
private final Log log

XSS_PROTECTION_HEADER_NAME	back to summary
private static final String XSS_PROTECTION_HEADER_NAME Deprecated Annotations @Deprecated

XSS_PROTECTION_HEADER_VALUE	back to summary
private static final String XSS_PROTECTION_HEADER_VALUE Deprecated Annotations @Deprecated

xssProtectionEnabled	back to summary
private boolean xssProtectionEnabled Deprecated Annotations @Deprecated

Constructor Detail

HttpHeaderSecurityFilter	back to summary
public HttpHeaderSecurityFilter()

Method Detail

doFilter back to summary

doFilter	back to summary
public void doFilter(ServletRequest request, ServletResponse response, FilterChain chain) throws IOException, ServletException Implements jakarta.servlet.Filter.doFilter. Doc from jakarta.servlet.Filter.doFilter. The `doFilter` method of the Filter is called by the container each time a request/response pair is passed through the chain due to a client request for a resource at the end of the chain. The FilterChain passed in to this method allows the Filter to pass on the request and response to the next entity in the chain. A typical implementation of this method would follow the following pattern:- 1. Examine the request 2. Optionally wrap the request object with a custom implementation to filter content or headers for input filtering 3. Optionally wrap the response object with a custom implementation to filter content or headers for output filtering 4. a) Either invoke the next entity in the chain using the FilterChain object (`chain.doFilter()`), 4. b) or not pass on the request/response pair to the next entity in the filter chain to block the request processing 5. Directly set headers on the response after invocation of the next entity in the filter chain. Parameters request:ServletRequest The request to process response:ServletResponse The response associated with the request chain:FilterChain Provides access to the next filter in the chain for this filter to pass the request and response to for further processing Annotations @Override Exceptions IOException: if an I/O error occurs during this filter's processing of the request ServletException: if the processing fails for any other reason

public void doFilter(ServletRequest request, ServletResponse response, FilterChain chain) throws IOException, ServletException

Implements jakarta.servlet.Filter.doFilter.

Doc from jakarta.servlet.Filter.doFilter.

The doFilter method of the Filter is called by the container each time a request/response pair is passed through the chain due to a client request for a resource at the end of the chain. The FilterChain passed in to this method allows the Filter to pass on the request and response to the next entity in the chain.

A typical implementation of this method would follow the following pattern:-
1. Examine the request
2. Optionally wrap the request object with a custom implementation to filter content or headers for input filtering
3. Optionally wrap the response object with a custom implementation to filter content or headers for output filtering
4. a) Either invoke the next entity in the chain using the FilterChain object (chain.doFilter()),
4. b) or not pass on the request/response pair to the next entity in the filter chain to block the request processing
5. Directly set headers on the response after invocation of the next entity in the filter chain.

Parameters

request:ServletRequest: The request to process
response:ServletResponse: The response associated with the request
chain:FilterChain: Provides access to the next filter in the chain for this filter to pass the request and response to for further processing

Annotations

@Override

Exceptions

IOException:: if an I/O error occurs during this filter's processing of the request
ServletException:: if the processing fails for any other reason

getAntiClickJackingOption	back to summary
public String getAntiClickJackingOption()

getAntiClickJackingUri	back to summary
public String getAntiClickJackingUri()

getHstsMaxAgeSeconds	back to summary
public int getHstsMaxAgeSeconds()

getLogger	back to summary
protected Log getLogger() Implements abstract org.apache.catalina.filters.FilterBase.getLogger. Annotations @Override

getLogger

back to summary

protected Log getLogger()

Implements abstract org.apache.catalina.filters.FilterBase.getLogger.

Annotations

@Override

init back to summary

init	back to summary
public void init(FilterConfig filterConfig) throws ServletException Overrides org.apache.catalina.filters.FilterBase.init. Overrides default jakarta.servlet.Filter.init. Doc from org.apache.catalina.filters.FilterBase.init. Iterates over the configuration parameters and either logs a warning, or throws an exception for any parameter that does not have a matching setter in this filter. Parameters filterConfig:FilterConfig The configuration information associated with the filter instance being initialised Annotations @Override Exceptions ServletException: if `isConfigProblemFatal()` returns `true` and a configured parameter does not have a matching setter

public void init(FilterConfig filterConfig) throws ServletException

Overrides org.apache.catalina.filters.FilterBase.init.

Overrides default jakarta.servlet.Filter.init.

Doc from org.apache.catalina.filters.FilterBase.init.

Iterates over the configuration parameters and either logs a warning, or throws an exception for any parameter that does not have a matching setter in this filter.

Parameters

filterConfig:FilterConfig: The configuration information associated with the filter instance being initialised

Annotations

@Override

Exceptions

ServletException:: if isConfigProblemFatal() returns true and a configured parameter does not have a matching setter

isAntiClickJackingEnabled	back to summary
public boolean isAntiClickJackingEnabled()

isBlockContentTypeSniffingEnabled	back to summary
public boolean isBlockContentTypeSniffingEnabled()

isConfigProblemFatal back to summary

isConfigProblemFatal	back to summary
protected boolean isConfigProblemFatal() Overrides org.apache.catalina.filters.FilterBase.isConfigProblemFatal. Doc from org.apache.catalina.filters.FilterBase.isConfigProblemFatal. Determines if an exception when calling a setter or an unknown configuration attribute triggers the failure of the this filter which in turn will prevent the web application from starting. Returns:boolean `true` if a problem should trigger the failure of this filter, else `false` Annotations @Override

protected boolean isConfigProblemFatal()

Overrides org.apache.catalina.filters.FilterBase.isConfigProblemFatal.

Doc from org.apache.catalina.filters.FilterBase.isConfigProblemFatal.

Determines if an exception when calling a setter or an unknown configuration attribute triggers the failure of the this filter which in turn will prevent the web application from starting.

Returns:boolean

true if a problem should trigger the failure of this filter, else false

Annotations

@Override

isHstsEnabled	back to summary
public boolean isHstsEnabled()

isHstsIncludeSubDomains	back to summary
public boolean isHstsIncludeSubDomains()

isHstsPreload	back to summary
public boolean isHstsPreload()

isXssProtectionEnabled	back to summary
public boolean isXssProtectionEnabled() Deprecated Annotations @Deprecated

setAntiClickJackingEnabled	back to summary
public void setAntiClickJackingEnabled(boolean antiClickJackingEnabled)

setAntiClickJackingOption	back to summary
public void setAntiClickJackingOption(String antiClickJackingOption)

setAntiClickJackingUri	back to summary
public void setAntiClickJackingUri(String antiClickJackingUri)

setBlockContentTypeSniffingEnabled	back to summary
public void setBlockContentTypeSniffingEnabled(boolean blockContentTypeSniffingEnabled)

setHstsEnabled	back to summary
public void setHstsEnabled(boolean hstsEnabled)

setHstsIncludeSubDomains	back to summary
public void setHstsIncludeSubDomains(boolean hstsIncludeSubDomains)

setHstsMaxAgeSeconds	back to summary
public void setHstsMaxAgeSeconds(int hstsMaxAgeSeconds)

setHstsPreload	back to summary
public void setHstsPreload(boolean hstsPreload)

setXssProtectionEnabled	back to summary
public void setXssProtectionEnabled(boolean xssProtectionEnabled) Deprecated Annotations @Deprecated

org.apache.catalina.filters back to summary

private final Enum HttpHeaderSecurityFilter.XFrameOption

Class Inheritance

extends Enum<HttpHeaderSecurityFilter.XFrameOption>

java.lang.Object
java.lang.Enum
org.apache.catalina.filters.HttpHeaderSecurityFilter.XFrameOption

Field Summary

Modifier and Type	Field and Description
public static final HttpHeaderSecurityFilter.XFrameOption	ALLOW_FROM
public static final HttpHeaderSecurityFilter.XFrameOption	DENY
private final String	headerValue
public static final HttpHeaderSecurityFilter.XFrameOption	SAME_ORIGIN

Constructor Summary

Access	Constructor and Description
private	XFrameOption(String headerValue)

Method Summary

Modifier and Type	Method and Description
public String	getHeaderValue()
public static HttpHeaderSecurityFilter.XFrameOption	valueOf(String name)
public static HttpHeaderSecurityFilter.XFrameOption[]	values()

Inherited from java.lang.Enum:: clone compareTo describeConstable equals finalize getDeclaringClass hashCode name ordinal toString valueOf

Field Detail

ALLOW_FROM	back to summary
public static final HttpHeaderSecurityFilter.XFrameOption ALLOW_FROM

DENY	back to summary
public static final HttpHeaderSecurityFilter.XFrameOption DENY

headerValue	back to summary
private final String headerValue

SAME_ORIGIN	back to summary
public static final HttpHeaderSecurityFilter.XFrameOption SAME_ORIGIN

Constructor Detail

XFrameOption	back to summary
private XFrameOption(String headerValue)

Method Detail

getHeaderValue	back to summary
public String getHeaderValue()

valueOf	back to summary
public static HttpHeaderSecurityFilter.XFrameOption valueOf(String name)

values	back to summary
public static HttpHeaderSecurityFilter.XFrameOption[] values()

public Class HttpHeaderSecurityFilter

Nested and Inner Type Summary

Field Summary

Constructor Summary

Method Summary

Field Detail

Constructor Detail

Method Detail

private final Enum HttpHeaderSecurityFilter.XFrameOption

Field Summary

Constructor Summary

Method Summary

Field Detail

Constructor Detail

Method Detail