Tom cat - Configure X-FRAME-OPTIONS

0

Hello, I'm trying to set up tomcat web.xml version 9.0.2, as documented in: link to allow the addition of iframe on a specific page, however you are presenting me with the following error:

javax.servlet.ServletException: The property [antiClickJackingOption] is not defined for filters of type [org.apache.catalina.filters.HttpHeaderSecurityFilter]
    at org.apache.catalina.filters.FilterBase.init(FilterBase.java:62)
    at org.apache.catalina.filters.HttpHeaderSecurityFilter.init(HttpHeaderSecurityFilter.java:68)
    at org.apache.catalina.core.ApplicationFilterConfig.initFilter(ApplicationFilterConfig.java:277)
    at org.apache.catalina.core.ApplicationFilterConfig.getFilter(ApplicationFilterConfig.java:258)
    at org.apache.catalina.core.ApplicationFilterConfig.<init>(ApplicationFilterConfig.java:104)
    at org.apache.catalina.core.StandardContext.filterStart(StandardContext.java:4491)
    at org.apache.catalina.core.StandardContext.startInternal(StandardContext.java:5131)
    at org.apache.catalina.util.LifecycleBase.start(LifecycleBase.java:183)
    at org.apache.catalina.manager.ManagerServlet.start(ManagerServlet.java:1309)
    at org.apache.catalina.manager.ManagerServlet.doGet(ManagerServlet.java:358)
    at javax.servlet.http.HttpServlet.service(HttpServlet.java:634)
    at javax.servlet.http.HttpServlet.service(HttpServlet.java:741)
    at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:231)
    at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:166)
    at org.apache.tomcat.websocket.server.WsFilter.doFilter(WsFilter.java:53)
    at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:193)
    at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:166)
    at org.apache.catalina.core.StandardWrapperValve.invoke(StandardWrapperValve.java:199)
    at org.apache.catalina.core.StandardContextValve.invoke(StandardContextValve.java:96)
    at org.apache.catalina.authenticator.AuthenticatorBase.invoke(AuthenticatorBase.java:619)
    at org.apache.catalina.valves.RequestFilterValve.process(RequestFilterValve.java:348)
    at org.apache.catalina.valves.RemoteAddrValve.invoke(RemoteAddrValve.java:52)
    at org.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.java:140)
    at org.apache.catalina.valves.ErrorReportValve.invoke(ErrorReportValve.java:81)
    at org.apache.catalina.valves.AbstractAccessLogValve.invoke(AbstractAccessLogValve.java:651)
    at org.apache.catalina.core.StandardEngineValve.invoke(StandardEngineValve.java:87)
    at org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:342)
    at org.apache.coyote.http11.Http11Processor.service(Http11Processor.java:501)
    at org.apache.coyote.AbstractProcessorLight.process(AbstractProcessorLight.java:66)
    at org.apache.coyote.AbstractProtocol$ConnectionHandler.process(AbstractProtocol.java:754)
    at org.apache.tomcat.util.net.NioEndpoint$SocketProcessor.doRun(NioEndpoint.java:1376)
    at org.apache.tomcat.util.net.SocketProcessorBase.run(SocketProcessorBase.java:49)
    at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1149)
    at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:624)
    at org.apache.tomcat.util.threads.TaskThread$WrappingRunnable.run(TaskThread.java:61)
    at java.lang.Thread.run(Thread.java:748)

My web.xml file is configured as follows for the quoted intent:

<filter>
        <filter-name>httpHeaderSecurity</filter-name>
        <filter-class>org.apache.catalina.filters.HttpHeaderSecurityFilter</filter-class>
        <init-param>
            <param-name>antiClickJackingEnabled</param-name>
            <param-value>true</param-value>
        </init-param>
        <init-param>
            <param-name>antiClickJackingOption</param-name>
            <param-value>ALLOW-FROM</param-value>
        </init-param>
        <init-param>
            <param-name>antiClickJackingUri</param-name>
            <param-value>https://www.google.com.br</param-value>
        </init-param>
    </filter>

    <filter-mapping> 
        <filter-name>httpHeaderSecurity</filter-name> 
        <url-pattern>/*</url-pattern>
    </filter-mapping>

I think it's important to note that the property belongs to the HttpHeaderSecurityFilter class that does not exist in the error states that it conforms to the documentation.

    
asked by anonymous 26.02.2018 / 20:32

0 answers