如何在tomcat上运行的Vue应用程序中添加安全标头

Question

我有一个部署在运行Tomcat9的服务器上的vue应用程序。HOw我可以向所有页面添加Feature-Policy和Expect-CT标头吗？

Answer 1

将报头添加到响应的过滤器类

import java.io.IOException;
import javax.servlet.Filter;
import javax.servlet.FilterChain;
import javax.servlet.FilterConfig;
import javax.servlet.ServletException;
import javax.servlet.ServletRequest;
import javax.servlet.ServletResponse;
import javax.servlet.http.HttpServletResponse;

public class MyCustomHeadersFilter implements Filter {

@Override
public void init(FilterConfig filterConfig) throws ServletException {
} 

@Override
public void doFilter(ServletRequest request, ServletResponse response, FilterChain chain)
        throws IOException, ServletException {
    
    HttpServletResponse httpResp = (HttpServletResponse) response;

    HeaderResponseWrapper headerResponseWrapper = new HeaderResponseWrapper(httpResp);

    headerResponseWrapper.setHeader("Cache-Control", "no-cache, no-store, must-revalidate"); // HTTP 1.1.
    headerResponseWrapper.setHeader("Pragma", "no-cache"); // HTTP 1.0.
    headerResponseWrapper.setHeader("Expires", "0"); // Proxies.

    chain.doFilter(request, headerResponseWrapper);
}

@Override
public void destroy() {
}
}

HeaderResponseWrapper类

import java.io.*;
import javax.servlet.http.*;

public class HeaderResponseWrapper extends HttpServletResponseWrapper {
private CharArrayWriter writer;
  
public HeaderResponseWrapper(HttpServletResponse response) {
    super(response);
    writer = new CharArrayWriter();
}
  
public PrintWriter getWriter() {
    return new PrintWriter(writer);
}
  
public String toString() {
    return writer.toString();
}
}

现在将这个类作为过滤器添加到tomcat的web.xml中，并将其映射到相关的URL

<filter>
<filter-name>MyCustomHeadersFilter</filter-name>
<filter-class>com.headers.config.MyCustomHeadersFilter</filter-class>
</filter>

<filter-mapping>
<filter-name>MyCustomHeadersFilter</filter-name>
<url-pattern>*.html</url-pattern>
</filter-mapping>