解決Tomcat配置“X-Frame-Options頭未設置”警告的過濾器

參考：黑夜的風

 

package com.xx.xx.service;

import javax.servlet.*;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;
import java.io.IOException;

public class XFrameOptionsHeaderFilter implements Filter {

    public XFrameOptionsHeaderFilter() {
    }

    public void init(FilterConfig config) throws ServletException {
    }

    public void doFilter(ServletRequest req, ServletResponse resp, FilterChain chain) throws IOException, ServletException {
        //必須
        HttpServletRequest request = (HttpServletRequest) req;
        HttpServletResponse response = (HttpServletResponse) resp;
        //實際設置
        response.setHeader("x-frame-options", "SAMEORIGIN");
        chain.doFilter(req, resp);
    }

    public void destroy() {
    }

}

 

在xml中加入

<!-- 配置Filter -->

<filter>
    <filter-name>XFrameOptionsHeaderFilter</filter-name>
    <filter-class>com.xx.xx.service.XFrameOptionsHeaderFilter</filter-class>
</filter>
<filter-mapping>
    <filter-name>XFrameOptionsHeaderFilter</filter-name>
    <url-pattern>/*</url-pattern>
</filter-mapping>

 

 效果如下

內嵌頁面也打不開了

 

 

如果配置  allow-from 

參考：https://developer.mozilla.org/en-US/docs/Web/Security/CSP/CSP_policy_directives 

 

chrome和Safari 是不支持的。

 需要加入

response.setHeader("Content-Security-Policy", "frame-ancestors "+address); //針對safi和chrome

 

如下圖（第三行是設置httponly屬性，參考：https://blog.csdn.net/zhaifengmin/article/details/54232630  ）

 

至此問題解決！