Headers in Tomcat

Question

I want to set two headers at Tomcat level. Setting these on Apache level will affect my applications. Below two headers

Set-Cookie HttpOnly;
Secure Strict-Transport-Security: max-age=31536000; includeSubDomains

Answer 1

You can use the HTTP Header Security Filter like this :

<filter>
  <filter-name>HTTP Header Security Filter</filter-name>
  <filter-class>org.apache.catalina.filters.HttpHeaderSecurityFilter</filter-class>
  <init-param>
    <param-name>hstsMaxAgeSeconds</param-name>
    <param-value>31536000</param-value>
  </init-param>
  <init-param>
    <param-name>hstsIncludeSubDomains</param-name>
    <param-value>true</param-value>
  </init-param>
</filter>
<filter-mapping>
  <filter-name>HTTP Header Security Filter</filter-name>
  <url-pattern>/*</url-pattern>
</filter-mapping>

For details read the documentation.