Release : v12.2 / v12.3
Component : AUTOMATION ENGINE
While this is Tomcat specific, the adding the following to conf/web.xml may be successful :
<filter>
<filter-name>httpHeaderSecurity</filter- name>
<filter-class>org.apache.catalina.filters. HttpHeaderSecurityFilter</ filter-class>
<async-supported>true</async-supported>
<init-param>
<param-name>antiClickJackingEnabled </param-name>
<param-value>true</param-value>
</init-param>
<init-param>
<param-name>hstsEnabled</param-name>
<param-value>true</param-value>
</init-param>
<init-param>
<param-name>hstsMaxAgeSeconds</param-name>
<param-value>31536000</param-value>
</init-param>
<init-param>
<param-name>hstsIncludeSubDomains</param- name>
<param-value>true</param-value>
</init-param>
<init-param>
<param-name>xssProtectionEnabled</param- name>
<param-value>true</param-value>
</init-param>
<init-param>
<param-name>blockContentTypeSniffingEnable </param-name>d
<param-value>true</param-value>
</init-param>
</filter>
<!-- The mapping for the HTTP header security Filter -->
<filter-mapping>
<filter-name>httpHeaderSecurity</filter- name>
<url-pattern>/*</url-pattern>
<dispatcher>REQUEST</dispatcher>
</filter-mapping>
See https://tomcat.apache.org/
Note: You may still see the HSTS vulnerability show up at https://tomcatservername.example.com:8443, but not at https://tomcatservername.example.com:8443/awi This is a product limitation with the integration with tomcat and one that would require an enhancement to the product to change. With the Jetty AWI, there are settings that can be put in place to fully resolve this. Please see the documentation for more information.