Difference between revisions of "Tomcat hardening"
Jump to navigation
Jump to search
old>Admin |
old>Admin |
||
| Line 23: | Line 23: | ||
<init-param> | <init-param> | ||
<param-name>entryPoints</param-name> | <param-name>entryPoints</param-name> | ||
<param-value>/login, /login.do</param-value> | <param-value>/login,/loginsso,/loginoauth,/mainpublic,/webinterface,/login.do</param-value> | ||
</init-param> | </init-param> | ||
</filter> | </filter> | ||
Revision as of 10:23, 7 February 2018
Secure headers (recommended)
In the SERVER web.xml (<tomcat>\conf\web.xml) add the following sections
<filter> <filter-name>httpHeaderSecurity</filter-name> <filter-class>org.apache.catalina.filters.HttpHeaderSecurityFilter</filter-class> <async-supported>true</async-supported> </filter>
<filter-mapping> <filter-name>httpHeaderSecurity</filter-name> <url-pattern>/*</url-pattern> </filter-mapping>
CRSF filter (optional)
In the APPLICATION web.xml (<tomcat>\webapps\<app>\WEB_INF\web.xml) add the following sections
<filter>
<filter-name>CsrfFilter</filter-name>
<filter-class>org.apache.catalina.filters.CsrfPreventionFilter</filter-class>
<init-param>
<param-name>entryPoints</param-name>
<param-value>/login,/loginsso,/loginoauth,/mainpublic,/webinterface,/login.do</param-value>
</init-param>
</filter>
<filter-mapping> <filter-name>CsrfFilter</filter-name> <url-pattern>/*</url-pattern> </filter-mapping>