You are viewing a plain text version of this content. The canonical link for it is here.
Posted to users@tomcat.apache.org by Joseph Morgan <jo...@ignitesales.com> on 2011/01/14 21:32:22 UTC
How to configure Tomcat/Coyote to deliver a P3P Header on Every Request
Using Tomcat 6.0.13, how do we configure the Coyote server to deliver a
P3P header on every request, even if for a JavaScript, Image, CSS, etc?
________________________________
Joseph M. Morgan
Ignite Sales, Inc.
Director of Technology and Operations
Office 972-789-5523
Email: joseph.morgan@ignitesales.com
Web: www.ignitesales.com
"Guaranteed Increase in Core Revenue for Banks"
RE: How to configure Tomcat/Coyote to deliver a P3P Header on Every Request
Posted by Joseph Morgan <jo...@ignitesales.com>.
Thanks... sometimes the easiest thing to do is the last thing you think
of... not to mention that my programmers said that filters would only
work if a servlet/jsp is called, but not if a JS or CSS file is
requested. Teaches me to listen to them!
-----Original Message-----
From: Ronald Klop [mailto:ronald-mailinglist@base.nl]
Sent: Friday, January 14, 2011 5:11 PM
To: Tomcat Users List
Subject: Re: How to configure Tomcat/Coyote to deliver a P3P Header on
Every Request
We do this with a filter mapped to /*.
Ronald.
Op vrijdag, 14 januari 2011 21:32 schreef Joseph Morgan
<jo...@ignitesales.com>:
>
> Using Tomcat 6.0.13, how do we configure the Coyote server to deliver
a
> P3P header on every request, even if for a JavaScript, Image, CSS,
etc?
>
>
>
> ________________________________
>
> Joseph M. Morgan
>
> Ignite Sales, Inc.
>
> Director of Technology and Operations
>
> Office 972-789-5523
>
> Email: joseph.morgan@ignitesales.com
>
> Web: www.ignitesales.com
>
>
>
> "Guaranteed Increase in Core Revenue for Banks"
>
>
>
>
>
>
>
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
For additional commands, e-mail: users-help@tomcat.apache.org
Re: How to configure Tomcat/Coyote to deliver a P3P Header on Every
Request
Posted by Ronald Klop <ro...@base.nl>.
We do this with a filter mapped to /*.
Ronald.
Op vrijdag, 14 januari 2011 21:32 schreef Joseph Morgan <jo...@ignitesales.com>:
>
> Using Tomcat 6.0.13, how do we configure the Coyote server to deliver a
> P3P header on every request, even if for a JavaScript, Image, CSS, etc?
>
>
>
> ________________________________
>
> Joseph M. Morgan
>
> Ignite Sales, Inc.
>
> Director of Technology and Operations
>
> Office 972-789-5523
>
> Email: joseph.morgan@ignitesales.com
>
> Web: www.ignitesales.com
>
>
>
> "Guaranteed Increase in Core Revenue for Banks"
>
>
>
>
>
>
>
Re: How to configure Tomcat/Coyote to deliver a P3P Header on Every Request
Posted by James Ng <ja...@ignitesales.com>.
Konstantin Kolinko <knst.kolinko <at> gmail.com> writes:
.
>
> Do you observe any pattern in which responses
have the headers and which do not?
>
> For me a caveat was that the URI must match not only the urirewrite
> rules, but also the filter mapping in web.xml, where this filter is
> defined.
>
>
> I used from + set without "to" and it worked.
>
> Best regards,
> Konstantin Kolinko
>
I've tried to follow the advice here with UrlRewriteFilter
and also tried the other approach suggested in this thread
by writing my own servlet filter.
With uri rewrite, I have changed my rule to
<rule>
<from>^(.*)$</from>
<to>$1</to>
<set type="response-header" name="P3P">CP="NOI DSP COR"</set>
</rule>
Changed my logLevel to TRACE, in my web.xml.
Some of my servlets get the P3P, but not all. I haven't been able to
identify a pattern of why yet. All the images, css,
and other static resources did not get the P3P header.
I tried a different approach. Instead of using UrlRewriteFilter,
I wrote my own servlet filter.
Adding the P3P header before and after calling
the FilterChain's doFilter method. i.e.
httpResponse.addHeader("P3P", "CP=\"NOI DSP COR \"");
a_chain.doFilter(a_request, a_response);
httpResponse.addHeader("P3P", "CP=\"NOI DSP COR \"");
Then implemented this filter in my tomcat global web.xml under conf/.
I was able to get the P3P header in all my static resources
such as images, css. I could also get the
P3P header in most of my servlets except for a few.
Seems to me, I should only need to add headers after
the response object has returned from the FilterChain.doFilter.
If someone has any idea why I had to add headers before
FilterChain.doFilter, it may shed some lights
to why I still have a few servlets not getting the P3P headers.
Or why some servlets get the P3P when we added it
before the FilterChain and some get it when we added
P3P after the FilterChain call.
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
For additional commands, e-mail: users-help@tomcat.apache.org
Re: How to configure Tomcat/Coyote to deliver a P3P Header on Every Request
Posted by Konstantin Kolinko <kn...@gmail.com>.
2011/1/18 James Ng <ja...@ignitesales.com>:
> But when I tried to set the P3P in the response header of every response using
> this rule, it wasn't successful.
> <rule>
> <from>.*</from>
> <set type="response-header" name="P3P">CP="NOI DSP COR"</set>
> </rule>
>
> I monitored my response headers and the P3P are not set.
Do you observe any pattern in which responses have the headers and which do not?
For me a caveat was that the URI must match not only the urirewrite
rules, but also the filter mapping in web.xml, where this filter is
defined.
Note, that you can turn on debug logging in url rewrite -- see
"logLevel" in the docs.
2011/1/18 André Warnier <aw...@ice-sa.com>:
> The documentation says : A "rule" must contain a "from" and a "to", and can
> have zero or more "condition" elements and zero or more and/or "set"
> elements.
I used from + set without "to" and it worked.
Best regards,
Konstantin Kolinko
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
For additional commands, e-mail: users-help@tomcat.apache.org
Re: How to configure Tomcat/Coyote to deliver a P3P Header on Every
Request
Posted by André Warnier <aw...@ice-sa.com>.
James Ng wrote:
...
>
> But when I tried to set the P3P in the response header of every response using
> this rule, it wasn't successful.
>
> <rule>
>
> <from>.*</from>
> <set type="response-header" name="P3P">CP="NOI DSP COR"</set>
>
> </rule>
>
> I monitored my response headers and the P3P are not set.
>
> I have tried several different variation of my rule in the off chance that it
> was a simple syntax mismatch e.g. trying without the CP, without the quotes etc.
>
The documentation says : A "rule" must contain a "from" and a "to", and can have zero or
more "condition" elements and zero or more and/or "set" elements.
So what happens when you try :
> <rule>
>
> <from>^(.*)$</from>
<to>$1</to>
> <set type="response-header" name="P3P">CP="NOI DSP COR"</set>
>
> </rule>
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
For additional commands, e-mail: users-help@tomcat.apache.org
Re: How to configure Tomcat/Coyote to deliver a P3P Header on Every Request
Posted by James Ng <ja...@ignitesales.com>.
Tim Funk <funkman <at> apache.org> writes:
>
> No "coding" needed if you use Url Rewrite Filter ...
> http://urlrewritefilter.googlecode.com
>
> <rule>
> <from>.*</from>
> <set type="response-header" name="P3P">P3P code here</set>
> </rule>
>
> -Tim
>
> On 1/17/2011 8:11 AM, Joseph Morgan wrote:
> > You know what... I need to learn to read what I write... you are correct, it
needs to be added to every response.
> >
> > Thanks
> >
> > -----Original Message-----
> > From: André Warnier [mailto:aw <at> ice-sa.com]
> > Sent: Friday, January 14, 2011 3:07 PM
> > To: Tomcat Users List
> > Subject: Re: How to configure Tomcat/Coyote to deliver a P3P Header on Every
Request
> >
> > Joseph Morgan wrote:
> >> Using Tomcat 6.0.13, how do we configure the Coyote server to deliver a
> >> P3P header on every request, even if for a JavaScript, Image, CSS, etc?
> >>
> > I don't know about the Coyote server, and it won't work for a request, but
if you are
> > talking about a Tomcat webapp and its responses, how about a servlet filter
mapped to "/*"
> > and adding such a header to every response ?
>
I have implemented Url Rewrite Filter and verified a simple url redirect works
with this rule.
<rule>
<from>/abc/</from>
<to type="redirect">/Alpine/</to>
</rule>
But when I tried to set the P3P in the response header of every response using
this rule, it wasn't successful.
<rule>
<from>.*</from>
<set type="response-header" name="P3P">CP="NOI DSP COR"</set>
</rule>
I monitored my response headers and the P3P are not set.
I have tried several different variation of my rule in the off chance that it
was a simple syntax mismatch e.g. trying without the CP, without the quotes etc.
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
For additional commands, e-mail: users-help@tomcat.apache.org
Re: How to configure Tomcat/Coyote to deliver a P3P Header on Every
Request
Posted by Tim Funk <fu...@apache.org>.
No "coding" needed if you use Url Rewrite Filter ...
http://urlrewritefilter.googlecode.com
<rule>
<from>.*</from>
<set type="response-header" name="P3P">P3P code here</set>
</rule>
-Tim
On 1/17/2011 8:11 AM, Joseph Morgan wrote:
> You know what... I need to learn to read what I write... you are correct, it needs to be added to every response.
>
> Thanks
>
> -----Original Message-----
> From: André Warnier [mailto:aw@ice-sa.com]
> Sent: Friday, January 14, 2011 3:07 PM
> To: Tomcat Users List
> Subject: Re: How to configure Tomcat/Coyote to deliver a P3P Header on Every Request
>
> Joseph Morgan wrote:
>> Using Tomcat 6.0.13, how do we configure the Coyote server to deliver a
>> P3P header on every request, even if for a JavaScript, Image, CSS, etc?
>>
> I don't know about the Coyote server, and it won't work for a request, but if you are
> talking about a Tomcat webapp and its responses, how about a servlet filter mapped to "/*"
> and adding such a header to every response ?
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
For additional commands, e-mail: users-help@tomcat.apache.org
RE: How to configure Tomcat/Coyote to deliver a P3P Header on Every Request
Posted by Joseph Morgan <jo...@ignitesales.com>.
You know what... I need to learn to read what I write... you are correct, it needs to be added to every response.
Thanks
-----Original Message-----
From: André Warnier [mailto:aw@ice-sa.com]
Sent: Friday, January 14, 2011 3:07 PM
To: Tomcat Users List
Subject: Re: How to configure Tomcat/Coyote to deliver a P3P Header on Every Request
Joseph Morgan wrote:
> Using Tomcat 6.0.13, how do we configure the Coyote server to deliver a
> P3P header on every request, even if for a JavaScript, Image, CSS, etc?
>
I don't know about the Coyote server, and it won't work for a request, but if you are
talking about a Tomcat webapp and its responses, how about a servlet filter mapped to "/*"
and adding such a header to every response ?
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
For additional commands, e-mail: users-help@tomcat.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
For additional commands, e-mail: users-help@tomcat.apache.org
Re: How to configure Tomcat/Coyote to deliver a P3P Header on Every
Request
Posted by André Warnier <aw...@ice-sa.com>.
Joseph Morgan wrote:
> Using Tomcat 6.0.13, how do we configure the Coyote server to deliver a
> P3P header on every request, even if for a JavaScript, Image, CSS, etc?
>
I don't know about the Coyote server, and it won't work for a request, but if you are
talking about a Tomcat webapp and its responses, how about a servlet filter mapped to "/*"
and adding such a header to every response ?
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
For additional commands, e-mail: users-help@tomcat.apache.org
RE: How to configure Tomcat/Coyote to deliver a P3P Header on Every Request
Posted by Joseph Morgan <jo...@ignitesales.com>.
>-----Original Message-----
>From: Caldarale, Charles R [mailto:Chuck.Caldarale@unisys.com]
>Sent: Friday, January 14, 2011 3:05 PM
>To: Tomcat Users List
>Subject: RE: How to configure Tomcat/Coyote to deliver a P3P Header on
Every Request
>> From: Joseph Morgan [mailto:joseph.morgan@ignitesales.com]
>> Subject: How to configure Tomcat/Coyote to deliver a P3P Header on
Every Request
>> Using Tomcat 6.0.13
>So what's your upgrade schedule? Once a decade?
It's an old system still running quite a few apps, but we're leaving it
for dead.
>> how do we configure the Coyote server to deliver a P3P header
>> on every request, even if for a JavaScript, Image, CSS, etc?
>Interesting question, especially in light of the following quote from a
related Mozilla bugzilla entry:
>"Ah the memories. We (IBM) wrote the original P3P implementation and
then Netscape proceeded to write their own. So both our >companies
wasted immense amounts of time that everyone thought was a crappy
proposal to begin with. Remove it."
>>https://bugzilla.mozilla.org/show_bug.cgi?id=225287#c12
Now THAT is a good quote! But, our old apps recently ran into problem
when our clients began loading these apps into div overlays, IE stopped
saving cookies. Further research took us down the road of studying P3P
headers and how browsers respond to them, and it seems that if the P3P
header is not returned on every request, IE throws the baby out with the
bath water.
> Write a filter.
Will do.... Thanks
- Chuck
THIS COMMUNICATION MAY CONTAIN CONFIDENTIAL AND/OR OTHERWISE PROPRIETARY
MATERIAL and is thus for use only by the intended recipient. If you
received this in error, please contact the sender and delete the e-mail
and its attachments from all computers.
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
For additional commands, e-mail: users-help@tomcat.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
For additional commands, e-mail: users-help@tomcat.apache.org
RE: How to configure Tomcat/Coyote to deliver a P3P Header on Every
Request
Posted by "Caldarale, Charles R" <Ch...@unisys.com>.
> From: Joseph Morgan [mailto:joseph.morgan@ignitesales.com]
> Subject: How to configure Tomcat/Coyote to deliver a P3P Header on Every Request
> Using Tomcat 6.0.13
So what's your upgrade schedule? Once a decade?
> how do we configure the Coyote server to deliver a P3P header
> on every request, even if for a JavaScript, Image, CSS, etc?
Interesting question, especially in light of the following quote from a related Mozilla bugzilla entry:
"Ah the memories. We (IBM) wrote the original P3P implementation and then Netscape proceeded to write their own. So both our companies wasted immense amounts of time that everyone thought was a crappy proposal to begin with. Remove it."
https://bugzilla.mozilla.org/show_bug.cgi?id=225287#c12
Write a filter.
- Chuck
THIS COMMUNICATION MAY CONTAIN CONFIDENTIAL AND/OR OTHERWISE PROPRIETARY MATERIAL and is thus for use only by the intended recipient. If you received this in error, please contact the sender and delete the e-mail and its attachments from all computers.
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
For additional commands, e-mail: users-help@tomcat.apache.org