Add HSTS feature to Tomcat

Question

Trust you all well.

My web application run on tomcat 6.0.43 and do not use apache or nginx at front.

I\'m already enforce my web from http redirect to https usi

Answer 1

You can add it using a filter. Add the following snippet to web.xml:

    HSTSFilter
    security.HSTSFilter

And then create a filter in your webapp:

package security;

import java.io.IOException;

import javax.servlet.Filter;
import javax.servlet.FilterChain;
import javax.servlet.FilterConfig;
import javax.servlet.ServletException;
import javax.servlet.ServletRequest;
import javax.servlet.ServletResponse;
import javax.servlet.http.HttpServletResponse;

public class HSTSFilter implements Filter {

    public void doFilter(ServletRequest req, ServletResponse res,
        FilterChain chain) throws IOException, ServletException {
        HttpServletResponse resp = (HttpServletResponse) res;

        if (req.isSecure())
            resp.setHeader("Strict-Transport-Security", "max-age=31622400; includeSubDomains");

        chain.doFilter(req, resp);
    }
}

Its also possible to add the filter using the global web.xml (conf/web.xml).