Tomcat hardening

Secure headers

In the SERVER web.xml (<tomcat>\conf\web.xml) add the following sections

 <filter>
   <filter-name>httpHeaderSecurity</filter-name>
   <filter-class>org.apache.catalina.filters.HttpHeaderSecurityFilter</filter-class>
   <async-supported>true</async-supported>
 </filter>

 <filter-mapping>
   <filter-name>httpHeaderSecurity</filter-name>
   <url-pattern>/*</url-pattern>
 </filter-mapping>

CRSF filter

In the APPLICATION web.xml (<tomcat>\webapps\<app>\WEB_INF\web.xml) add the following sections

 <filter>
   <filter-name>CsrfFilter</filter-name>
   <filter-class>org.apache.catalina.filters.CsrfPreventionFilter</filter-class>
   <init-param>
     <param-name>entryPoints</param-name>
     <param-value>/login, /login.do</param-value>
   </init-param>
 </filter>

 <filter-mapping>
   <filter-name>CsrfFilter</filter-name>
   <url-pattern>/*</url-pattern>
 </filter-mapping>