在 wso2am-4.0.0 中添加安全标头（sts & csp & Referer 标头）

Question

我正在尝试按照我公司安全团队的指导在所有门户中添加这两个标头。到目前为止，我已经尝试在deployment.toml 中添加一些配置。这只会在开发门户中带来 sts 标头，但不会在其他门户中带来。

[[tomcat.carbon.filter]]
name = "HttpHeaderSecurityFilter"
class = "org.apache.catalina.filters.HttpHeaderSecurityFilter"
init_param_name = "hstsMaxAgeSeconds"
init_param_value = "15768000"

[[tomcat.carbon.filter_mapping]]
name = "HttpHeaderSecurityFilter"
url_pattern = ["*"]

我还尝试在此处提供的 web.xml 文件中添加过滤器：wso2am-4.0.0/repository/conf/tomcat/carbon/WEB-INF，但此配置似乎在启动时被重写。

[2024-04-29 16:13:46,247]  INFO {org.wso2.config.mapper.ConfigParser} - Configurations Changed in :repository/resources/security/sslprofiles.xml
[2024-04-29 16:13:46,249]  INFO {org.wso2.config.mapper.ConfigParser} - Configurations Changed in :repository/resources/security/listenerprofiles.xml
[2024-04-29 16:13:46,249]  INFO {org.wso2.config.mapper.ConfigParser} - Configurations Changed in :repository/conf/deployment.toml
[2024-04-29 16:13:46,250]  INFO {org.wso2.config.mapper.ConfigParser} - Configurations Changed in :repository/conf/tomcat/carbon/WEB-INF/web.xml

有人知道我该如何解决这个问题吗？

Answer 1

尝试添加这些

[[tomcat.filter]]
name = "httpHeaderSecurity"
class = "org.apache.catalina.filters.HttpHeaderSecurityFilter"
async_supported = true

[tomcat.filter.init_params]
hstsEnabled = true
hstsMaxAgeSeconds = 31536000
hstsIncludeSubDomains = true

[[tomcat.filter_mapping]]
name = "httpHeaderSecurity"
url_pattern = "/*"
dispatchers = "REQUEST"