Talk:Clickjacking Protection for Java EE - Revision history

Vinay Chilakamarri at 04:33, 24 October 2013

2013-10-24T04:33:18Z

Rikard Jespersen: Created page with "I have implemented this in tomcat 5.5.31 but I didn't get it to work. First I got an error that the java version was wrong. So I recompiled the class using the same sdk version ..."

2011-06-30T11:49:26Z

Created page with "I have implemented this in tomcat 5.5.31 but I didn't get it to work. First I got an error that the java version was wrong. So I recompiled the class using the same sdk version ..."

New page

I have implemented this in tomcat 5.5.31 but I didn't get it to work. First I got an error that the java version was wrong. So I recompiled the class using the same sdk version I use for the tomcat. This removed the error messages and everything looks dandy. Problem is that the sites are still "framable" in both Internet Explorer 8 and Firefox 5. Clearly I'm doing something wrong but I can't just seem to figure out what.

Is there a way to check if the headers are being sent out as suppossed to, or any other test to check what I'm doing wrong?

← Older revision		Revision as of 04:33, 24 October 2013
Line 2:		Line 2:

	Is there a way to check if the headers are being sent out as suppossed to, or any other test to check what I'm doing wrong?		Is there a way to check if the headers are being sent out as suppossed to, or any other test to check what I'm doing wrong?
		+
		+
		+
		+	The issue is with the sample provided in the zip file. The wiki page shows the method as:
		+
		+	public void doFilter(ServletRequest request, ServletResponse response, FilterChain chain) throws IOException, ServletException {
		+	HttpServletResponse res = (HttpServletResponse)response;
		+	res.addHeader("X-FRAME-OPTIONS", mode );
		+	chain.doFilter(request, response);
		+	}
		+
		+	You will need to make sure that the source code in the zip file has the chain.doFilter AFTER the res.addHeader method. However in the current sample the filtering is done BEFORE the header was added and thus it does not work.