如何给Tomcat +启用HSTS（HTTP严格传输安全）JIRA

Question

这将是非常有益的，如果有人建议我，使HSTS（HTTP严格传输安全）头

我JIRA应用Tomcat上运行并前面没有Apache或NGINX。

我想为JIRA应用程序设置HSTS响应头，请提出如何在Tomcat中实现它。

在此先感谢。

Answer 1

我想这就是你要找的。 我把它从https://bz.apache.org/bugzilla/attachment.cgi?id=30003&action=edit

<filter> 
    <filter-name>HstsFilter</filter-name> 
    <filter-class>org.apache.catalina.filters.HstsFilter</filter-class> 
    <init-param> 
     <param-name>maxAgeSeconds</param-name> 
     <param-value>31536000</param-value> 
    </init-param> 
    <init-param> 
     <param-name>includeSubDomains</param-name> 
     <param-value>true</param-value> 
    </init-param> 
</filter> 
<filter-mapping> 
    <filter-name>HstsFilter</filter-name> 
    <url-pattern>/*</url-pattern> 
</filter-mapping> 

package org.apache.catalina.filters; 

import java.io.IOException; 

import javax.servlet.FilterChain; 
import javax.servlet.FilterConfig; 
import javax.servlet.ServletException; 
import javax.servlet.ServletRequest; 
import javax.servlet.ServletResponse; 
import javax.servlet.http.HttpServletResponse; 

import org.apache.juli.logging.Log; 
import org.apache.juli.logging.LogFactory; 

public class HstsFilter extends FilterBase { 
    private static final String HEADER_NAME = "Strict-Transport-Security"; 
    private static final String MAX_AGE_DIRECTIVE = "max-age=%s"; 
    private static final String INCLUDE_SUB_DOMAINS_DIRECTIVE = "includeSubDomains"; 

    private static final Log log = LogFactory.getLog(HstsFilter.class); 

    // The default is "0" like recommended in section 11.2 of RFC 6797 
    private int maxAgeSeconds = 0; 
    private boolean includeSubDomains = false; 

    private String directives; 

    public void setMaxAgeSeconds(int maxAgeSeconds) { 
     this.maxAgeSeconds = maxAgeSeconds; 
    } 

    public void setIncludeSubDomains(boolean includeSubDomains) { 
     this.includeSubDomains = includeSubDomains; 
    } 

    @Override 
    public void doFilter(ServletRequest request, ServletResponse response, 
      FilterChain chain) throws IOException, ServletException { 
     chain.doFilter(request, response); 

     // Note that the HSTS header must not be included in HTTP responses 
     // conveyed over non-secure transport 
     if (request.isSecure() && response instanceof HttpServletResponse) { 
      HttpServletResponse res = (HttpServletResponse) response; 
      res.addHeader(HEADER_NAME, this.directives); 
     } 
    } 

    @SuppressWarnings("boxing") 
    @Override 
    public void init(FilterConfig filterConfig) throws ServletException { 
     super.init(filterConfig); 
     if (this.maxAgeSeconds < 0) { 
      throw new ServletException(sm.getString(
        "hsts.invalidParameterValue", this.maxAgeSeconds, 
        "maxAgeSeconds")); 
     } 
     this.directives = String.format(MAX_AGE_DIRECTIVE, this.maxAgeSeconds); 
     if (this.includeSubDomains) { 
      this.directives += (" ; " + INCLUDE_SUB_DOMAINS_DIRECTIVE); 
     } 
    } 

    @Override 
    protected Log getLogger() { 
     return log; 
    } 
} 

检查我附加的链接的代码。