Setting security related HTTP Response headers

To improve the security of the connection it is required to set certain security related HTTP Response headers in the web.xml of your Apache Tomcat installation.

1. Locate and edit the web.xml file of your Tomcat installation, e.g.:

   vi /etc/tomcat9/web.xml

2. Paste the following lines in the section Built In Filter Definitions:

   <!-- ================== Built In Filter Definitions ===================== -->
   
   <filter>
   	<filter-name>httpHeaderSecurity</filter-name>
   	<filter-class>org.apache.catalina.filters.HttpHeaderSecurityFilter</filter-class>
   	<async-supported>true</async-supported>
   
   	<init-param>
   		<param-name>antiClickJackingOption</param-name>
   		<param-value>DENY</param-value>
   		<!-- <param-value>SAMEORIGIN</param-value> -->
   	</init-param>
   
   	<init-param>
   		<param-name>xssProtectionEnabled</param-name>
   		<param-value>true</param-value>
   		<!-- true represents 1; mode=block -->
   	</init-param>
   </filter>

3. Paste the following lines in the section Built In Filter Mappings:

   <!-- ==================== Built In Filter Mappings ====================== -->
   
   <filter-mapping>
   	<filter-name>httpHeaderSecurity</filter-name>
   	<url-pattern>/*</url-pattern>
   	<!-- <dispatcher>REQUEST</dispatcher> -->
   </filter-mapping>

4. Save your changes.
5. Restart Tomcat:

   sudo service tomcat9 restart