does org.apache.catalina.filters.HttpHeaderSecurityFilter needs INCLUDE,FORWARD dispatcher

Viewed 13

i am running Tomcat application with following HttpHeaderSecurityFilter filter configuration

 <filter>
        <filter-name>httpHeaderSecurity</filter-name>
        <filter-class>org.apache.catalina.filters.HttpHeaderSecurityFilter</filter-class>
        <async-supported>true</async-supported>
        <init-param>
            <param-name>blockContentTypeSniffingEnabled</param-name>
            <param-value>false</param-value>
        </init-param>
        <init-param>
            <param-name>antiClickJackingEnabled</param-name>
            <param-value>true</param-value>
        </init-param>
        <init-param>
            <param-name>antiClickJackingOption</param-name>
            <param-value>SAMEORIGIN</param-value>
        </init-param>
        <init-param>
            <param-name>xssProtectionEnabled</param-name>
            <param-value>false</param-value>
        </init-param>
        <init-param>
            <param-name>hstsEnabled</param-name>
            <param-value>false</param-value>
        </init-param>
        <init-param>
            <param-name>hstsMaxAgeSeconds</param-name>
            <param-value>60</param-value>
        </init-param>
    </filter>
    <filter-mapping>
        <filter-name>httpHeaderSecurity</filter-name>
        <url-pattern>/*</url-pattern>
        <dispatcher>INCLUDE</dispatcher>
        <dispatcher>FORWARD</dispatcher>
        <dispatcher>REQUEST</dispatcher>
    </filter-mapping>

is it mandatory or required to add INCLUDE , FORWARD dispatcher ?

        <dispatcher>INCLUDE</dispatcher>
        <dispatcher>FORWARD</dispatcher>

without adding these dispatchers application running fine ,

but following exception throws after configuring FORWARD , INCLUDE dispatcher in httpHeaderSecurity filter

[14:33:52:923]|[09-22-2022]|[org.apache.catalina.core.ContainerBase.[Catalina].[localhost].[/event].[org.apache.jsp.WEB_002dINF.jsp.index2_jsp]]|[SEVERE]|[81]: Servlet.service() for servlet [org.apache.jsp.WEB_002dINF.jsp.index2_jsp] threw exception| 
javax.servlet.ServletException: Unable to add HTTP headers since response is already committed on entry to the HTTP header security Filter
    at org.apache.catalina.filters.HttpHeaderSecurityFilter.doFilter(HttpHeaderSecurityFilter.java:101)

does it is required to add these dispatchers , shall i remove FORWARD , INCLUDE dispatcher entries ?

0 Answers
Related