http - 在 JBoss EAP 7 中配置 Http header

Question

您知道是否有标准的方法来配置 JBoss EAP 7 发送给客户端的 Http header ？我主要对能够配置以下内容感兴趣:

• X-XSS-保护
• X 框架选项
• 严格的运输安全
• 内容安全政策
• X-Content-Type-Options

我在网上找到了这个链接

https://blog.akquinet.de/2017/08/03/wildfly-8-10-and-jboss-eap-7-verbose-http-headers/

但我不确定是否可以将它用于我感兴趣的标题。

谢谢!

Answer 1

根据 JBoss EAP 7 文档:

Previous releases of JBoss EAP supported valves. Valves are custom classes inserted into the request processing pipeline for an application before servlet filters to make changes to the request or perform additional processing. Global valves are inserted into the request processing pipeline of all deployed applications. Authenticator valves authenticate the credentials of the request. Valves were created by extending the org.apache.catalina.valves.ValveBase class and configured in the element of the jboss-web.xml descriptor file.

Undertow, which replaces JBoss Web in JBoss EAP 7, does not support valves; however, you should be able to achieve similar functionality by using Undertow handlers. Undertow includes a number of built-in handlers that provide common functionality. It also provides the ability to create custom handlers, which can be used to replace custom valve functionality.

对于复杂的情况，您仍然可以走这条路，但是现在在使用 Undertow 时添加响应 header 已被简化，因为您只需将自定义 header 添加到 JBoss Undertow 子系统，您的过滤器部分将从此改变:

<filters>
    <response-header name="server-header" header-name="Server" header-value="JBoss-EAP/7"/>
    <response-header name="x-powered-by-header" header-name="X-Powered-By" header-value="Undertow/1"/>
</filters>

对此:

<filters>
    <response-header name="server-header" header-name="Server" header-value="JBoss-EAP/7"/>
    <response-header name="x-powered-by-header" header-name="X-Powered-By" header-value="Undertow/1"/>
    <!-- Begin custom Headers -->
    <response-header name="x-xss-protection" header-name="X-XSS-Protection" header-value=""/>
    <response-header name="x-frame-options" header-name="X-Frame-Options" header-value=""/>
    <response-header name="strict-transport-security" header-name="Strict-Transport-Security" header-value=""/>
    <response-header name="content-security-policy" header-name="Content-Security-Policy" header-value=""/>
    <response-header name="x-Content-type-options" header-name="X-Content-Type-Options" header-value=""/>
</filters>

我会把它留给其他人来确定他们想为标题放置的值(在复制/粘贴期间保存一些编辑)