Tomcat 点击劫持漏洞修改

修改 tomcat 的点击劫持漏洞

修改web服务器配置，添加X-Frame-Options响应头。赋值有如下三种：
1、DENY：不能被嵌入到任何iframe或者frame中
2、SAMEORIGIN:页面只能被本站页面嵌入到iframe或者frame中
3、ALLOW-FROM Uri：只能被嵌入到指定域名的框架中

<filter>     <filter-name>httpHeaderSecurity</filter-name>     <filter-class>org.apache.catalina.filters.HttpHeaderSecurityFilter</filter-class>     <init-param>         <param-name>antiClickJackingEnabled</param-name>         <param-value>true</param-value>     </init-param>     <init-param>         <param-name>antiClickJackingOption</param-name>         <param-value>SAMEORIGIN</param-value>     </init-param>     <async-supported>true</async-supported> </filter> <filter-mapping>     <filter-name>httpHeaderSecurity</filter-name>     <url-pattern>/*</url-pattern> </filter-mapping>

文章来源: Tomcat 点击劫持漏洞修改