tomcat httpHeaderSecurity.jar

X-Frame-Options标头不包含在HTTP响应中以防止'ClickJacking'攻击 缺少X-Frame-Options头 缺少X-Content-Type-Options Header 未启用Web浏览器XSS保护 等的解决办法 在tomcat下的conf里的web.xml中增加以下过滤器 <filter> <filter-name>httpHeaderSecurity</filter-name> <filter-class>org.apache.catalina.filters.HttpHeaderSecurityFilter</filter-class> <async-supported>true</async-supported> <init-param> <param-name>antiClickJackingEnabled</param-name> <param-value>true</param-value> </init-param> <init-param> <param-name>antiClickJackingOption</param-name> <param-value>SAMEORIGIN</param-value> </init-param> </filter> <filter-mapping> <filter-name>httpHeaderSecurity</filter-name> <url-pattern>/*</url-pattern> </filter-mapping> 注意：tomcat8以下版本需要下载httpHeaderSecurity.jar这个包