i am running Tomcat application with following HttpHeaderSecurityFilter filter configuration
<filter>
<filter-name>httpHeaderSecurity</filter-name>
<filter-class>org.apache.catalina.filters.HttpHeaderSecurityFilter</filter-class>
<async-supported>true</async-supported>
<init-param>
<param-name>blockContentTypeSniffingEnabled</param-name>
<param-value>false</param-value>
</init-param>
<init-param>
<param-name>antiClickJackingEnabled</param-name>
<param-value>true</param-value>
</init-param>
<init-param>
<param-name>antiClickJackingOption</param-name>
<param-value>SAMEORIGIN</param-value>
</init-param>
<init-param>
<param-name>xssProtectionEnabled</param-name>
<param-value>false</param-value>
</init-param>
<init-param>
<param-name>hstsEnabled</param-name>
<param-value>false</param-value>
</init-param>
<init-param>
<param-name>hstsMaxAgeSeconds</param-name>
<param-value>60</param-value>
</init-param>
</filter>
<filter-mapping>
<filter-name>httpHeaderSecurity</filter-name>
<url-pattern>/*</url-pattern>
<dispatcher>INCLUDE</dispatcher>
<dispatcher>FORWARD</dispatcher>
<dispatcher>REQUEST</dispatcher>
</filter-mapping>
is it mandatory or required to add INCLUDE , FORWARD dispatcher ?
<dispatcher>INCLUDE</dispatcher>
<dispatcher>FORWARD</dispatcher>
without adding these dispatchers application running fine ,
but following exception throws after configuring FORWARD , INCLUDE dispatcher in httpHeaderSecurity filter
[14:33:52:923]|[09-22-2022]|[org.apache.catalina.core.ContainerBase.[Catalina].[localhost].[/event].[org.apache.jsp.WEB_002dINF.jsp.index2_jsp]]|[SEVERE]|[81]: Servlet.service() for servlet [org.apache.jsp.WEB_002dINF.jsp.index2_jsp] threw exception|
javax.servlet.ServletException: Unable to add HTTP headers since response is already committed on entry to the HTTP header security Filter
at org.apache.catalina.filters.HttpHeaderSecurityFilter.doFilter(HttpHeaderSecurityFilter.java:101)
does it is required to add these dispatchers , shall i remove FORWARD , INCLUDE dispatcher entries ?