set the headers rather than add them

markt-asf · markt-asf · commit d564fc963484 · 2015-05-16T09:37:26.000Z
Add header names to the docs and make clear that any existing headers will be replaced. Add the filter tot he security howto git-svn-id: https://svn.apache.org/repos/asf/tomcat/trunk@1679716 13f79535-47bb-0310-9956-ffa450edef68
diff --git a/java/org/apache/catalina/filters/HttpHeaderSecurityFilter.java b/java/org/apache/catalina/filters/HttpHeaderSecurityFilter.java
@@ -89,18 +89,18 @@ public void doFilter(ServletRequest request, ServletResponse response,
 
         // HSTS
         if (hstsEnabled && request.isSecure() && response instanceof HttpServletResponse) {
-            ((HttpServletResponse) response).addHeader(HSTS_HEADER_NAME, hstsHeaderValue);
+            ((HttpServletResponse) response).setHeader(HSTS_HEADER_NAME, hstsHeaderValue);
         }
 
         // anti click-jacking
         if (antiClickJackingEnabled && response instanceof HttpServletResponse) {
-            ((HttpServletResponse) response).addHeader(
+            ((HttpServletResponse) response).setHeader(
                     ANTI_CLICK_JACKING_HEADER_NAME, antiClickJackingHeaderValue);
         }
 
         // Block content type sniffing
         if (blockContentTypeSniffingEnabled && response instanceof HttpServletResponse) {
-            ((HttpServletResponse) response).addHeader(BLOCK_CONTENT_TYPE_SNIFFING_HEADER_NAME,
+            ((HttpServletResponse) response).setHeader(BLOCK_CONTENT_TYPE_SNIFFING_HEADER_NAME,
                     BLOCK_CONTENT_TYPE_SNIFFING_HEADER_VALUE);
         }
         chain.doFilter(request, response);
diff --git a/webapps/docs/config/filter.xml b/webapps/docs/config/filter.xml
@@ -724,9 +724,11 @@ FINE: Request "/docs/config/manager.html" with response status "200"
     <attributes>
 
       <attribute name="hstsEnabled" required="false">
-        <p>Will an HTTP Strict Transport Security (HSTS) header be added to the
-        response. See <a href="http://tools.ietf.org/html/rfc6797">RFC 6797</a>
-        for further details of HSTS. If not specified, the default value of
+        <p>Will an HTTP Strict Transport Security (HSTS) header
+        (<code>Strict-Transport-Security</code>) be set on the response for
+        secure requests. Any HSTS header already present will be replaced. See
+        <a href="http://tools.ietf.org/html/rfc6797">RFC 6797</a> for further
+        details of HSTS. If not specified, the default value of
         <code>true</code> will be used.</p>
       </attribute>
 
@@ -743,8 +745,9 @@ FINE: Request "/docs/config/manager.html" with response status "200"
       </attribute>
 
       <attribute name="antiClickJackingEnabled" required="false">
-        <p>Should the anti click-jacking <code>X-Frame-Options</code> be added
-        to the response. If not specified, the default value of
+        <p>Should the anti click-jacking header (<code>X-Frame-Options</code>)
+        be set on the response. Any anti click-jacking header already present
+        will be replaced. If not specified, the default value of
         <code>true</code> will be used.</p>
       </attribute>
 
@@ -762,9 +765,10 @@ FINE: Request "/docs/config/manager.html" with response status "200"
       </attribute>
 
       <attribute name="blockContentTypeSniffingEnabled" required="false">
-        <p>Should the header that blocks content type sniffing be added to every
-        response. If not specified, the default value of <code>true</code> will
-        be used.</p>
+        <p>Should the header that blocks content type sniffing
+        (<code>X-Content-Type-Options</code>) be set on every response. If
+        already present, the header will be replaced. If not specified, the
+        default value of <code>true</code> will be used.</p>
       </attribute>
 
     </attributes>
diff --git a/webapps/docs/security-howto.xml b/webapps/docs/security-howto.xml
@@ -468,6 +468,13 @@
     can be configured and used to reject requests that had errors during
     request parameter parsing. Without the filter the default behaviour is
     to ignore invalid or excessive parameters.</p>
+
+    <p><a href="config/filter.html">HttpHeaderSecurityFilter</a> can be
+    used to add headers to responses to improve security. If clients access
+    Tomcat directly, then you probably want to enable this filter and all the
+    headers it sets unless your application is already setting them. If Tomcat
+    is accessed via a reverse proxy, then the configuration of this filter needs
+    to be co-ordinated with any headers that the reverse proxy sets.</p>
   </section>
 
   <section name="General">

Original file line number	Diff line number	Diff line change
`@@ -89,18 +89,18 @@ public void doFilter(ServletRequest request, ServletResponse response,`
`89`	`89`
`90`	`90`	`// HSTS`
`91`	`91`	`if (hstsEnabled && request.isSecure() && response instanceof HttpServletResponse) {`
`92`		`- ((HttpServletResponse) response).addHeader(HSTS_HEADER_NAME, hstsHeaderValue);`
	`92`	`+ ((HttpServletResponse) response).setHeader(HSTS_HEADER_NAME, hstsHeaderValue);`
`93`	`93`	`}`
`94`	`94`
`95`	`95`	`// anti click-jacking`
`96`	`96`	`if (antiClickJackingEnabled && response instanceof HttpServletResponse) {`
`97`		`- ((HttpServletResponse) response).addHeader(`
	`97`	`+ ((HttpServletResponse) response).setHeader(`
`98`	`98`	`ANTI_CLICK_JACKING_HEADER_NAME, antiClickJackingHeaderValue);`
`99`	`99`	`}`
`100`	`100`
`101`	`101`	`// Block content type sniffing`
`102`	`102`	`if (blockContentTypeSniffingEnabled && response instanceof HttpServletResponse) {`
`103`		`- ((HttpServletResponse) response).addHeader(BLOCK_CONTENT_TYPE_SNIFFING_HEADER_NAME,`
	`103`	`+ ((HttpServletResponse) response).setHeader(BLOCK_CONTENT_TYPE_SNIFFING_HEADER_NAME,`
`104`	`104`	`BLOCK_CONTENT_TYPE_SNIFFING_HEADER_VALUE);`
`105`	`105`	`}`
`106`	`106`	`chain.doFilter(request, response);`