You are viewing a plain text version of this content. The canonical link for it is here.
Posted to users@tomcat.apache.org by "Alejandro Vargas M." <al...@kymsolutions.com> on 2017/11/01 19:37:31 UTC
security headers
Hello,
I recently used on web.xml
<filter>
<filter-name>httpHeaderSecurity</filter-name>
<filter-class>org.apache.catalina.filters.HttpHeaderSecurityFilter</filter-class>
<async-supported>true</async-supported>
</filter>
<filter-mapping>
<filter-name>httpHeaderSecurity</filter-name>
<url-pattern>/*</url-pattern>
</filter-mapping>
to enable some security headers, but it won't enable Content Security
Policy header. Is there anyway to enable Content Security Policy at top
server level???
Thanks in advance.
--
Re: security headers
Posted by Christopher Schultz <ch...@christopherschultz.net>.
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
Alejandro,
On 11/3/17 5:54 PM, Alejandro Vargas M. wrote:
> You can help with an example of this url-rewrite to add this
> header,
The url-rewrite user manual is quite comprehensive, including many
examples. I'm sure you can figure it out.
- -chris
> On 11/01/2017 02:03 PM, Christopher Schultz wrote: Alejandro,
>
> On 11/1/17 3:37 PM, Alejandro Vargas M. wrote:
>>>> Hello,
>>>>
>>>> I recently used on web.xml
>>>>
>>>> <filter> <filter-name>httpHeaderSecurity</filter-name>
>>>> <filter-class>org.apache.catalina.filters.HttpHeaderSecurityFilter<
/fi
>
>>>>
lter-class>
>>>> <async-supported>true</async-supported> </filter>
>>>>
>>>> <filter-mapping>
>>>> <filter-name>httpHeaderSecurity</filter-name>
>>>> <url-pattern>/*</url-pattern> </filter-mapping>
>>>>
>>>> to enable some security headers, but it won't enable Content
>>>> Security Policy header. Is there anyway to enable Content
>>>> Security Policy at top server level???
> What were you expecting that Filter to generate for you? A header
> which disables everything? Not terribly useful.
>
> My recommendation would be to use something like url-rewrite[1] to
> add headers to every outgoing response. url-rewrite has very
> similar capabilities to httpd's mod_headers (and much more, of
> course).
>
> -chris
>
> [1] http://tuckey.org/urlrewrite/
>>
>> ---------------------------------------------------------------------
>>
>>
To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
>> For additional commands, e-mail: users-help@tomcat.apache.org
>>
>>
>
> --
>
>
>
>
> Alejandro Vargas Mayorga /*Gerente Desarrollo C.A. & C.*/ *Tel.
> 506- 7232-3366* *Email:**alejandro.vargas@kymsolutions.com*
> <ma...@kymsolutions.com>*
> **www.kymsolutions.com* <http://www.kymsolutions.com/>* Visite
> nuestra aula virtual! *
>
-----BEGIN PGP SIGNATURE-----
Comment: GPGTools - http://gpgtools.org
Comment: Using GnuPG with Thunderbird - http://www.enigmail.net/
iQIzBAEBCAAdFiEEMmKgYcQvxMe7tcJcHPApP6U8pFgFAln90yQACgkQHPApP6U8
pFiy9xAAyLtluQed3UzQBa6CkoQCAWAL8rQkXiD2CVPaGRrH+cl79M6JzOoZxDXw
L+9hmwVYZhDljctwmsmP4jzjJSib8A/VwLoGEakoz1T6XvECuBt6+E8vb98e63Lu
EAeZcLPUQnluGsDdZmi5hIyS55/1L0Pr0Ef/3ndhmg6a8wKnHcwTaep+idrS73aT
jUs7YQzY+x0+ZvSfpJMbuGP3aqaYA0D/BRKYY9PAfK1pZsYypyinyNljGDe1Ks2I
NHs+KPX7h2QwF/hGaW7ERB9urLCz76cO2Q0nWTvXDuO5GrBbw3ADzouPxRYC1JF2
z+x94gK22pP0eQP+P+SabyDwEbhZj2MUdlK0XsHsMnCDSExzxCIf1ZG/l/fZ6Dk0
2ru1frNEBOTO/W5jqAzRHijvkEmNXzRKQuoCRMI28ybLI795qHn21RqRnzmAvhxg
zyLqBrhq/Oyt3SUE+U0xYscABgjBV1a46lDyw4S3f/q4CK0lmgCTmftr+nfqodb6
75+RIL24jQYah0CQMryyS1tWP8zDprk1FO6zxam3owUoxOeB4YLz9t0Iv1UMVReT
vfhQBulADm7rECegoRoDvDGII9sYqaRPqn2VN8bpFPPtQJPLghisZC9+XRXOy8Qr
3mDPEkQNRSfkkmZD6yVNU0lHccfidrmAgpLm5nYU00R4pEPOxtI=
=USq0
-----END PGP SIGNATURE-----
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
For additional commands, e-mail: users-help@tomcat.apache.org
Re: security headers
Posted by "Alejandro Vargas M." <al...@kymsolutions.com>.
You can help with an example of this url-rewrite to add this header,
Please,
Thanks in advance.
On 11/01/2017 02:03 PM, Christopher Schultz wrote:
> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA256
>
> Alejandro,
>
> On 11/1/17 3:37 PM, Alejandro Vargas M. wrote:
>> Hello,
>>
>> I recently used on web.xml
>>
>> <filter> <filter-name>httpHeaderSecurity</filter-name>
>> <filter-class>org.apache.catalina.filters.HttpHeaderSecurityFilter</fi
> lter-class>
>> <async-supported>true</async-supported> </filter>
>>
>> <filter-mapping> <filter-name>httpHeaderSecurity</filter-name>
>> <url-pattern>/*</url-pattern> </filter-mapping>
>>
>> to enable some security headers, but it won't enable Content
>> Security Policy header. Is there anyway to enable Content Security
>> Policy at top server level???
> What were you expecting that Filter to generate for you? A header
> which disables everything? Not terribly useful.
>
> My recommendation would be to use something like url-rewrite[1] to add
> headers to every outgoing response. url-rewrite has very similar
> capabilities to httpd's mod_headers (and much more, of course).
>
> - -chris
>
> [1] http://tuckey.org/urlrewrite/
> -----BEGIN PGP SIGNATURE-----
> Comment: GPGTools - http://gpgtools.org
> Comment: Using GnuPG with Thunderbird - http://www.enigmail.net/
>
> iQIzBAEBCAAdFiEEMmKgYcQvxMe7tcJcHPApP6U8pFgFAln6KJkACgkQHPApP6U8
> pFjuWRAAilRKahVEge71VBJrhragUyZuKR/uqEwfwpYj9Zq5DzI3I0JT6jwD8kwE
> //iuxBgDroVH/Xedn9oiMen9u1wSpf4p4fCQY0xcP99l6QnlgReimEM7Aoi24hTc
> WFgYlA2DVsKvmU0qjaI8HQoBrN+n8A+4Qhxu4fj5knNT1Sk1KppYDl/l6bkaI3Lc
> oPAvbYJbR2OV9SwCBoKFNjEPZwK9kTZhAr74gbErS/OZHcQAynZjHPcYl4+2K6Uj
> 98T3VKu6NIif5g3ry6TA9YYe5Dn3DyqBkY6wlAI91gRn7KjESDcJPcCiYglYDHqP
> 37ZdcP6LPmySFlBaug5E9811lyKIHnkpv/0OTaFM3AH0sulazBvLu38Ea5yeZQFC
> CofoYTMAY8KAlfwzKn+3RhTTQA8lmKHF/dVxQBRqP3vbN/+KU1KzqZmn2Q6KoYH+
> Lf+gMJjeLE/0/8X9CnTaFPkmg7VbYgGmhGzgFkD85YTswT962L8M5evG1xdHaNiM
> ZZDEeYLWC/Cjdqvht3zQ0gvmI35pI1q2K/fnYb+mrV0eIi/rcosz99GQVpTTqS58
> wCtIAKLChLuxuWoGp0+1+sI0ugwn9RmsIft34QBM1Us/FxGYc0Ou5VpBHE0JeYG8
> G8RjZ+9eonM5ScwPrAZKZ7pd6qfCHY24/OvK6vT4HbRdqJbvWT8=
> =j1H+
> -----END PGP SIGNATURE-----
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
> For additional commands, e-mail: users-help@tomcat.apache.org
>
>
--
Alejandro Vargas Mayorga
/*Gerente Desarrollo C.A. & C.*/
*Tel. 506- 7232-3366*
*Email:**alejandro.vargas@kymsolutions.com*
<ma...@kymsolutions.com>*
**www.kymsolutions.com* <http://www.kymsolutions.com/>*
Visite nuestra aula virtual! *
Re: security headers
Posted by Christopher Schultz <ch...@christopherschultz.net>.
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
André,
On 11/2/17 9:35 AM, André Warnier (tomcat) wrote:
> You seem to be responding on the wrong thread, but here are some
> answers anyway (will save Christopher some typing)
(I was trying not to pollute this hijacked thread.)
> When tomcat starts, it will check if APR is available. If yes,
> tomcat will use it, because it is probably a bit faster than the
> Java alternative. If APR is not available, tomcat will use the
> standard Java functions, which are maybe a bit slower.
By many orders of magnitude[1]. If you are terminating TLS at Tomcat,
you'll definitely want to use APR or NIO+OpenSSL (which requires
Tomcat 8.5 or Tomcat 9.0). Or if you only have very minimal traffic.
- -chris
[1] https://schd.ws/hosted_files/apachecon2017/93/TomcatOpenSSL.pdf
See slides 15-17
-----BEGIN PGP SIGNATURE-----
Comment: GPGTools - http://gpgtools.org
Comment: Using GnuPG with Thunderbird - http://www.enigmail.net/
iQJRBAEBCAA7FiEEMmKgYcQvxMe7tcJcHPApP6U8pFgFAln7cg0dHGNocmlzQGNo
cmlzdG9waGVyc2NodWx0ei5uZXQACgkQHPApP6U8pFjxGQ/9F2+Z2Lx6hnRv+gSd
0gCw/Is3QzRU6YSo7msa2hHMsZjDzeCBFBP6+kR+HDGY5iQY3aPXobJel054m/WT
xWi8/mWZdONgWZW6JXkpM0zjKzUnAlkP9sfZFY0HqlgUZ6bjGuw8588oXFfnATGb
jb0kQN56hypFub5dw9946RPZHrMc2yxBD62IVicEPGz9MBbKm5LRRbldxZtxmgOS
zmTuxLi0N0Zy8BhFDOX/VIcokBdzIlTr1y7PxUGbPpMBJxT2ws82etS2Nod1BuIu
MKd7th2fgvowmf3w8Eyk00r+yKxCbHvENfdbwiHMIH3n4PhGQ/GVXmdpe4f8ATKU
JyWQzj32WibTvwtSAPvK9XYBWwdgpCxeSMTXaed8pCyKNAr/yPanAzD66wBUCd/N
fXFbJLaxpq+2IxfcHYBrceiCT4SQ2//ghD3T4QTVwHkZ6zx1wsV8eBj15WVuGjau
j/REfglgfaCLWb/HSrLNCwGirXxbyQ6fS2hGfmgHfDP+n6reUXZGEeKw5t4asbfi
VsxGvKkFoTcGkG0OQDu4XW96vLHV2hXiOooY/8FN7+zWhT4Spb6TajWU/wUWbEbg
Cp/V6fv2iVDNiz69zqph/EAQ4LMwThi5utMrPGzyXVMRLqRKSoPLl7lap0hYathj
mr2PQWH5WVgSAVh6GW3jThWYHXE=
=QZ/g
-----END PGP SIGNATURE-----
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
For additional commands, e-mail: users-help@tomcat.apache.org
RE: security headers
Posted by "Cheltenham, Chris" <cc...@philasd.org>.
Yes that was the wrong thread but thank you.
===========================
Thank You;
Chris Cheltenham
Technology Services
The School District of Philadelphia
Work # 215-400-5025
Cell # 215-301-6571
-----Original Message-----
From: André Warnier (tomcat) [mailto:aw@ice-sa.com]
Sent: Thursday, November 2, 2017 9:36 AM
To: users@tomcat.apache.org
Subject: Re: security headers
You seem to be responding on the wrong thread, but here are some answers
anyway (will save Christopher some typing)
On 02.11.2017 13:55, Cheltenham, Chris wrote:
> Mr. Shultz,
>
> I really appreciate your detailed answers.
> Helps me out a lot.
>
> I am now thinking big picture because my application does not require
> APR..
>
> May I ask this , what exactly does APR give me for apache-tomcat?
APR stands for "Apache Portable Run-time".
Here is one explanation :
It is a software library, containing a series of functions which are often
used by Apache Foundation programs of all kinds (not only tomcat),
particularly in what regards network interfaces and protocols.
The people who make this APR, make sure that it is available for many
platforms (Windows, Liux etc.), and that it is really optimised for each of
these different platforms.
To access the network, tomcat can do it in 2 different ways :
1) by using standard Java functions, which always work, but are not
particularly optimised for any platform or
2) if APR is available, then tomcat can use instead, some calls which exist
in the APR library, and which may be more optimised fo the current platform
on which it is running
When tomcat starts, it will check if APR is available. If yes, tomcat will
use it, because it is probably a bit faster than the Java alternative.
If APR is not available, tomcat will use the standard Java functions, which
are maybe a bit slower.
And just to let you know that, it will print a friendly message to the log,
to let you know that maybe this is not the most optimal solution, in terms
of ultimate tomcat performance. But this is just an informational message,
and you can decide to ignore it, and run tomcat anyway without APR (which
many people do, and most of the time they will not notice the difference).
There is a secondary effect which needs to be considered when using SSL
(HTTPS) :
When tomcat finds and uses APR, it uses APR functions to access SSL sockets.
And these APR functions rely on the underlying presence of SSL libraries
provided by another package, named OpenSSL. These OpenSSL libraries require
a particular format for the SSL keys and key stores.
When tomcat does not find APR, it will use the builtin Java functions for
SSL. And these builtin functions require another format for the SSL keys and
key stores.
So the parameters used in the <Connector> elements are a bit different in
each case.
This is well explained in the tomcat on-line documentation.
>
> I am thinking to scrap the whole APR install.
>
> The reason I am trying to install it is because of my anal need to
> have clean logs.
I won't even try to interpret this..
> I can’t stand any messages suggesting or recommending that I do this
> or that.
They are just friendly messages, like the Amazon "other readers who have
purchased this book, have also liked this : ... "
> I have always tried to accommodate those recommendations.
Ah, ok. I thought you could not stand them ?
> However, in this case it may be the best to ignore the catalane log
> message saying that I should install APR.
>
catalane ? that's been quite a bit in the news lately. But we're quite
apolitical here, and so is tomcat usually.
>
> ===========================
>
> Thank You;
>
> Chris Cheltenham
> Technology Services
> The School District of Philadelphia
>
> Work # 215-400-5025
> Cell # 215-301-6571
>
> -----Original Message-----
> From: Christopher Schultz [mailto:chris@christopherschultz.net]
> Sent: Wednesday, November 1, 2017 4:04 PM
> To: users@tomcat.apache.org
> Subject: Re: security headers
>
> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA256
>
> Alejandro,
>
> On 11/1/17 3:37 PM, Alejandro Vargas M. wrote:
>> Hello,
>>
>> I recently used on web.xml
>>
>> <filter> <filter-name>httpHeaderSecurity</filter-name>
>> <filter-class>org.apache.catalina.filters.HttpHeaderSecurityFilter</fi
> lter-class>
>>
>> <async-supported>true</async-supported> </filter>
>>
>> <filter-mapping> <filter-name>httpHeaderSecurity</filter-name>
>> <url-pattern>/*</url-pattern> </filter-mapping>
>>
>> to enable some security headers, but it won't enable Content Security
>> Policy header. Is there anyway to enable Content Security Policy at
>> top server level???
>
> What were you expecting that Filter to generate for you? A header which
> disables everything? Not terribly useful.
>
> My recommendation would be to use something like url-rewrite[1] to add
> headers to every outgoing response. url-rewrite has very similar
> capabilities to httpd's mod_headers (and much more, of course).
>
> - -chris
>
> [1] http://tuckey.org/urlrewrite/
> -----BEGIN PGP SIGNATURE-----
> Comment: GPGTools - http://gpgtools.org
> Comment: Using GnuPG with Thunderbird - http://www.enigmail.net/
>
> iQIzBAEBCAAdFiEEMmKgYcQvxMe7tcJcHPApP6U8pFgFAln6KJkACgkQHPApP6U8
> pFjuWRAAilRKahVEge71VBJrhragUyZuKR/uqEwfwpYj9Zq5DzI3I0JT6jwD8kwE
> //iuxBgDroVH/Xedn9oiMen9u1wSpf4p4fCQY0xcP99l6QnlgReimEM7Aoi24hTc
> WFgYlA2DVsKvmU0qjaI8HQoBrN+n8A+4Qhxu4fj5knNT1Sk1KppYDl/l6bkaI3Lc
> oPAvbYJbR2OV9SwCBoKFNjEPZwK9kTZhAr74gbErS/OZHcQAynZjHPcYl4+2K6Uj
> 98T3VKu6NIif5g3ry6TA9YYe5Dn3DyqBkY6wlAI91gRn7KjESDcJPcCiYglYDHqP
> 37ZdcP6LPmySFlBaug5E9811lyKIHnkpv/0OTaFM3AH0sulazBvLu38Ea5yeZQFC
> CofoYTMAY8KAlfwzKn+3RhTTQA8lmKHF/dVxQBRqP3vbN/+KU1KzqZmn2Q6KoYH+
> Lf+gMJjeLE/0/8X9CnTaFPkmg7VbYgGmhGzgFkD85YTswT962L8M5evG1xdHaNiM
> ZZDEeYLWC/Cjdqvht3zQ0gvmI35pI1q2K/fnYb+mrV0eIi/rcosz99GQVpTTqS58
> wCtIAKLChLuxuWoGp0+1+sI0ugwn9RmsIft34QBM1Us/FxGYc0Ou5VpBHE0JeYG8
> G8RjZ+9eonM5ScwPrAZKZ7pd6qfCHY24/OvK6vT4HbRdqJbvWT8=
> =j1H+
> -----END PGP SIGNATURE-----
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
> For additional commands, e-mail: users-help@tomcat.apache.org
>
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
> For additional commands, e-mail: users-help@tomcat.apache.org
>
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
For additional commands, e-mail: users-help@tomcat.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
For additional commands, e-mail: users-help@tomcat.apache.org
Re: security headers
Posted by "André Warnier (tomcat)" <aw...@ice-sa.com>.
You seem to be responding on the wrong thread, but here are some answers anyway
(will save Christopher some typing)
On 02.11.2017 13:55, Cheltenham, Chris wrote:
> Mr. Shultz,
>
> I really appreciate your detailed answers.
> Helps me out a lot.
>
> I am now thinking big picture because my application does not require APR..
>
> May I ask this , what exactly does APR give me for apache-tomcat?
APR stands for "Apache Portable Run-time".
Here is one explanation :
It is a software library, containing a series of functions which are often used by Apache
Foundation programs of all kinds (not only tomcat), particularly in what regards network
interfaces and protocols.
The people who make this APR, make sure that it is available for many platforms (Windows,
Liux etc.), and that it is really optimised for each of these different platforms.
To access the network, tomcat can do it in 2 different ways :
1) by using standard Java functions, which always work, but are not particularly optimised
for any platform
or
2) if APR is available, then tomcat can use instead, some calls which exist in the APR
library, and which may be more optimised fo the current platform on which it is running
When tomcat starts, it will check if APR is available. If yes, tomcat will use it, because
it is probably a bit faster than the Java alternative.
If APR is not available, tomcat will use the standard Java functions, which are maybe a
bit slower.
And just to let you know that, it will print a friendly message to the log, to let you
know that maybe this is not the most optimal solution, in terms of ultimate tomcat
performance. But this is just an informational message, and you can decide to ignore it,
and run tomcat anyway without APR (which many people do, and most of the time they will
not notice the difference).
There is a secondary effect which needs to be considered when using SSL (HTTPS) :
When tomcat finds and uses APR, it uses APR functions to access SSL sockets. And these APR
functions rely on the underlying presence of SSL libraries provided by another package,
named OpenSSL. These OpenSSL libraries require a particular format for the SSL keys and
key stores.
When tomcat does not find APR, it will use the builtin Java functions for SSL. And these
builtin functions require another format for the SSL keys and key stores.
So the parameters used in the <Connector> elements are a bit different in each case.
This is well explained in the tomcat on-line documentation.
>
> I am thinking to scrap the whole APR install.
>
> The reason I am trying to install it is because of my anal need to have
> clean logs.
I won't even try to interpret this..
> I can’t stand any messages suggesting or recommending that I do this or
> that.
They are just friendly messages, like the Amazon "other readers who have purchased this
book, have also liked this : ... "
> I have always tried to accommodate those recommendations.
Ah, ok. I thought you could not stand them ?
> However, in this case it may be the best to ignore the catalane log message
> saying that I should install APR.
>
catalane ? that's been quite a bit in the news lately. But we're quite apolitical here,
and so is tomcat usually.
>
> ===========================
>
> Thank You;
>
> Chris Cheltenham
> Technology Services
> The School District of Philadelphia
>
> Work # 215-400-5025
> Cell # 215-301-6571
>
> -----Original Message-----
> From: Christopher Schultz [mailto:chris@christopherschultz.net]
> Sent: Wednesday, November 1, 2017 4:04 PM
> To: users@tomcat.apache.org
> Subject: Re: security headers
>
> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA256
>
> Alejandro,
>
> On 11/1/17 3:37 PM, Alejandro Vargas M. wrote:
>> Hello,
>>
>> I recently used on web.xml
>>
>> <filter> <filter-name>httpHeaderSecurity</filter-name>
>> <filter-class>org.apache.catalina.filters.HttpHeaderSecurityFilter</fi
> lter-class>
>>
>> <async-supported>true</async-supported> </filter>
>>
>> <filter-mapping> <filter-name>httpHeaderSecurity</filter-name>
>> <url-pattern>/*</url-pattern> </filter-mapping>
>>
>> to enable some security headers, but it won't enable Content Security
>> Policy header. Is there anyway to enable Content Security Policy at
>> top server level???
>
> What were you expecting that Filter to generate for you? A header which
> disables everything? Not terribly useful.
>
> My recommendation would be to use something like url-rewrite[1] to add
> headers to every outgoing response. url-rewrite has very similar
> capabilities to httpd's mod_headers (and much more, of course).
>
> - -chris
>
> [1] http://tuckey.org/urlrewrite/
> -----BEGIN PGP SIGNATURE-----
> Comment: GPGTools - http://gpgtools.org
> Comment: Using GnuPG with Thunderbird - http://www.enigmail.net/
>
> iQIzBAEBCAAdFiEEMmKgYcQvxMe7tcJcHPApP6U8pFgFAln6KJkACgkQHPApP6U8
> pFjuWRAAilRKahVEge71VBJrhragUyZuKR/uqEwfwpYj9Zq5DzI3I0JT6jwD8kwE
> //iuxBgDroVH/Xedn9oiMen9u1wSpf4p4fCQY0xcP99l6QnlgReimEM7Aoi24hTc
> WFgYlA2DVsKvmU0qjaI8HQoBrN+n8A+4Qhxu4fj5knNT1Sk1KppYDl/l6bkaI3Lc
> oPAvbYJbR2OV9SwCBoKFNjEPZwK9kTZhAr74gbErS/OZHcQAynZjHPcYl4+2K6Uj
> 98T3VKu6NIif5g3ry6TA9YYe5Dn3DyqBkY6wlAI91gRn7KjESDcJPcCiYglYDHqP
> 37ZdcP6LPmySFlBaug5E9811lyKIHnkpv/0OTaFM3AH0sulazBvLu38Ea5yeZQFC
> CofoYTMAY8KAlfwzKn+3RhTTQA8lmKHF/dVxQBRqP3vbN/+KU1KzqZmn2Q6KoYH+
> Lf+gMJjeLE/0/8X9CnTaFPkmg7VbYgGmhGzgFkD85YTswT962L8M5evG1xdHaNiM
> ZZDEeYLWC/Cjdqvht3zQ0gvmI35pI1q2K/fnYb+mrV0eIi/rcosz99GQVpTTqS58
> wCtIAKLChLuxuWoGp0+1+sI0ugwn9RmsIft34QBM1Us/FxGYc0Ou5VpBHE0JeYG8
> G8RjZ+9eonM5ScwPrAZKZ7pd6qfCHY24/OvK6vT4HbRdqJbvWT8=
> =j1H+
> -----END PGP SIGNATURE-----
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
> For additional commands, e-mail: users-help@tomcat.apache.org
>
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
> For additional commands, e-mail: users-help@tomcat.apache.org
>
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
For additional commands, e-mail: users-help@tomcat.apache.org
Re: security headers
Posted by Christopher Schultz <ch...@christopherschultz.net>.
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
Chris,
On 11/2/17 8:55 AM, Cheltenham, Chris wrote:
> Mr. Shultz,
>
> I really appreciate your detailed answers. Helps me out a lot.
>
> I am now thinking big picture because my application does not
> require APR.
Wrong thread?
- -chris
-----BEGIN PGP SIGNATURE-----
Comment: GPGTools - http://gpgtools.org
Comment: Using GnuPG with Thunderbird - http://www.enigmail.net/
iQIzBAEBCAAdFiEEMmKgYcQvxMe7tcJcHPApP6U8pFgFAln7GkwACgkQHPApP6U8
pFgqZBAAmUWC0MHbURbl2RF9pTVkybij6eEPeNNXUVYjZx+3tcJygV7k0uavm57b
SNKGrZTtLoMx9PwYfzxstPb4Bb6bsxjxItAmLX8eePSgT5ZzL3aX2xZVUYqPrkTE
772IYExFuQUd0npH6yYVxamQNXXa0yFye8ajdSZoMfkWa5pMY0pgbnlpoLa//jxM
tAKTqbl1fuC0JAe3X5R+276hXH+RX+OUbumkRYM66I99wLW6VRtiuCFlpx7snG4b
ljcDVnHtqrob84uqYqu+Imce5RXXkeH6aPDezOQsQqhrUYTnlymA8hK43RoDY+RE
EgK9j9+2U5embmULw9S1Yt08UnGxq5WIsiuxdyrFpQVE0L2SBCKhDE8RXNXRCkVQ
dP3E2ImnrrtgFK1sqorozNd1G9DTYb90maojkAWEu/tZ676ejCnBQmnDkLzOdstq
Mg3o2aT0kv0vcLQ4kFBlmCyltEVCfLakHLeuwuiHlNLs3aoqrxOLbzF5ufvc6mUk
2X2QPAuxr2xvqU0loyPOY1JbFSTynAc6vhLpKNXxAXH62P8ex2OJZo1iqp7bNjUL
e+b1z4oUPXb57g+SSL6Ol76iYTP273lXMRD8xejUnrQZjlNtau5KMOGp1SYNqE+Y
uIdJIp897DiL1xSIhEsVaguo9MXtmXHN/aq2sNNCFi8DWpkthtk=
=GQu3
-----END PGP SIGNATURE-----
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
For additional commands, e-mail: users-help@tomcat.apache.org
RE: security headers
Posted by "Cheltenham, Chris" <cc...@philasd.org>.
Mr. Shultz,
I really appreciate your detailed answers.
Helps me out a lot.
I am now thinking big picture because my application does not require APR.
May I ask this , what exactly does APR give me for apache-tomcat?
I am thinking to scrap the whole APR install.
The reason I am trying to install it is because of my anal need to have
clean logs.
I can’t stand any messages suggesting or recommending that I do this or
that.
I have always tried to accommodate those recommendations.
However, in this case it may be the best to ignore the catalane log message
saying that I should install APR.
===========================
Thank You;
Chris Cheltenham
Technology Services
The School District of Philadelphia
Work # 215-400-5025
Cell # 215-301-6571
-----Original Message-----
From: Christopher Schultz [mailto:chris@christopherschultz.net]
Sent: Wednesday, November 1, 2017 4:04 PM
To: users@tomcat.apache.org
Subject: Re: security headers
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
Alejandro,
On 11/1/17 3:37 PM, Alejandro Vargas M. wrote:
> Hello,
>
> I recently used on web.xml
>
> <filter> <filter-name>httpHeaderSecurity</filter-name>
> <filter-class>org.apache.catalina.filters.HttpHeaderSecurityFilter</fi
lter-class>
>
> <async-supported>true</async-supported> </filter>
>
> <filter-mapping> <filter-name>httpHeaderSecurity</filter-name>
> <url-pattern>/*</url-pattern> </filter-mapping>
>
> to enable some security headers, but it won't enable Content Security
> Policy header. Is there anyway to enable Content Security Policy at
> top server level???
What were you expecting that Filter to generate for you? A header which
disables everything? Not terribly useful.
My recommendation would be to use something like url-rewrite[1] to add
headers to every outgoing response. url-rewrite has very similar
capabilities to httpd's mod_headers (and much more, of course).
- -chris
[1] http://tuckey.org/urlrewrite/
-----BEGIN PGP SIGNATURE-----
Comment: GPGTools - http://gpgtools.org
Comment: Using GnuPG with Thunderbird - http://www.enigmail.net/
iQIzBAEBCAAdFiEEMmKgYcQvxMe7tcJcHPApP6U8pFgFAln6KJkACgkQHPApP6U8
pFjuWRAAilRKahVEge71VBJrhragUyZuKR/uqEwfwpYj9Zq5DzI3I0JT6jwD8kwE
//iuxBgDroVH/Xedn9oiMen9u1wSpf4p4fCQY0xcP99l6QnlgReimEM7Aoi24hTc
WFgYlA2DVsKvmU0qjaI8HQoBrN+n8A+4Qhxu4fj5knNT1Sk1KppYDl/l6bkaI3Lc
oPAvbYJbR2OV9SwCBoKFNjEPZwK9kTZhAr74gbErS/OZHcQAynZjHPcYl4+2K6Uj
98T3VKu6NIif5g3ry6TA9YYe5Dn3DyqBkY6wlAI91gRn7KjESDcJPcCiYglYDHqP
37ZdcP6LPmySFlBaug5E9811lyKIHnkpv/0OTaFM3AH0sulazBvLu38Ea5yeZQFC
CofoYTMAY8KAlfwzKn+3RhTTQA8lmKHF/dVxQBRqP3vbN/+KU1KzqZmn2Q6KoYH+
Lf+gMJjeLE/0/8X9CnTaFPkmg7VbYgGmhGzgFkD85YTswT962L8M5evG1xdHaNiM
ZZDEeYLWC/Cjdqvht3zQ0gvmI35pI1q2K/fnYb+mrV0eIi/rcosz99GQVpTTqS58
wCtIAKLChLuxuWoGp0+1+sI0ugwn9RmsIft34QBM1Us/FxGYc0Ou5VpBHE0JeYG8
G8RjZ+9eonM5ScwPrAZKZ7pd6qfCHY24/OvK6vT4HbRdqJbvWT8=
=j1H+
-----END PGP SIGNATURE-----
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
For additional commands, e-mail: users-help@tomcat.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
For additional commands, e-mail: users-help@tomcat.apache.org
Re: security headers
Posted by Christopher Schultz <ch...@christopherschultz.net>.
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
Alejandro,
On 11/1/17 3:37 PM, Alejandro Vargas M. wrote:
> Hello,
>
> I recently used on web.xml
>
> <filter> <filter-name>httpHeaderSecurity</filter-name>
> <filter-class>org.apache.catalina.filters.HttpHeaderSecurityFilter</fi
lter-class>
>
> <async-supported>true</async-supported> </filter>
>
> <filter-mapping> <filter-name>httpHeaderSecurity</filter-name>
> <url-pattern>/*</url-pattern> </filter-mapping>
>
> to enable some security headers, but it won't enable Content
> Security Policy header. Is there anyway to enable Content Security
> Policy at top server level???
What were you expecting that Filter to generate for you? A header
which disables everything? Not terribly useful.
My recommendation would be to use something like url-rewrite[1] to add
headers to every outgoing response. url-rewrite has very similar
capabilities to httpd's mod_headers (and much more, of course).
- -chris
[1] http://tuckey.org/urlrewrite/
-----BEGIN PGP SIGNATURE-----
Comment: GPGTools - http://gpgtools.org
Comment: Using GnuPG with Thunderbird - http://www.enigmail.net/
iQIzBAEBCAAdFiEEMmKgYcQvxMe7tcJcHPApP6U8pFgFAln6KJkACgkQHPApP6U8
pFjuWRAAilRKahVEge71VBJrhragUyZuKR/uqEwfwpYj9Zq5DzI3I0JT6jwD8kwE
//iuxBgDroVH/Xedn9oiMen9u1wSpf4p4fCQY0xcP99l6QnlgReimEM7Aoi24hTc
WFgYlA2DVsKvmU0qjaI8HQoBrN+n8A+4Qhxu4fj5knNT1Sk1KppYDl/l6bkaI3Lc
oPAvbYJbR2OV9SwCBoKFNjEPZwK9kTZhAr74gbErS/OZHcQAynZjHPcYl4+2K6Uj
98T3VKu6NIif5g3ry6TA9YYe5Dn3DyqBkY6wlAI91gRn7KjESDcJPcCiYglYDHqP
37ZdcP6LPmySFlBaug5E9811lyKIHnkpv/0OTaFM3AH0sulazBvLu38Ea5yeZQFC
CofoYTMAY8KAlfwzKn+3RhTTQA8lmKHF/dVxQBRqP3vbN/+KU1KzqZmn2Q6KoYH+
Lf+gMJjeLE/0/8X9CnTaFPkmg7VbYgGmhGzgFkD85YTswT962L8M5evG1xdHaNiM
ZZDEeYLWC/Cjdqvht3zQ0gvmI35pI1q2K/fnYb+mrV0eIi/rcosz99GQVpTTqS58
wCtIAKLChLuxuWoGp0+1+sI0ugwn9RmsIft34QBM1Us/FxGYc0Ou5VpBHE0JeYG8
G8RjZ+9eonM5ScwPrAZKZ7pd6qfCHY24/OvK6vT4HbRdqJbvWT8=
=j1H+
-----END PGP SIGNATURE-----
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
For additional commands, e-mail: users-help@tomcat.apache.org