|
26 | 26 | import javax.servlet.http.HttpServletResponse; |
27 | 27 |
|
28 | 28 | /** |
29 | | - * The {@code ClickjackFilter} is discussed at |
30 | | - * @{link http://www.owasp.org/index.php/ClickjackFilter_for_Java_EE OWASP Clickjack Filter for JavaEE} |
| 29 | + * The {@code ClickjackFilter} is configured as follows: |
31 | 30 | * <pre> |
32 | | - * <filter> |
33 | | - * <filter-name>ClickjackFilterDeny</filter-name> |
34 | | - * <filter-class>org.owasp.filters.ClickjackFilter</filter-class> |
35 | | - * <init-param> |
36 | | - * <param-name>mode</param-name> |
37 | | - * <param-value>DENY</param-value> |
38 | | - * </init-param> |
39 | | - * </filter> |
| 31 | + * |
| 32 | + * <filter> |
| 33 | + * <filter-name>ClickjackFilterDeny</filter-name> |
| 34 | + * <filter-class>org.owasp.filters.ClickjackFilter</filter-class> |
| 35 | + * <init-param> |
| 36 | + * <param-name>mode</param-name> |
| 37 | + * <param-value>DENY</param-value> |
| 38 | + * </init-param> |
| 39 | + * </filter> |
40 | 40 | * |
41 | | - * <filter> |
42 | | - * <filter-name>ClickjackFilterSameOrigin</filter-name> |
43 | | - * <filter-class>org.owasp.filters.ClickjackFilter</filter-class> |
44 | | - * <init-param> |
45 | | - * <param-name>mode</param-name> |
46 | | - * <param-value>SAMEORIGIN</param-value> |
47 | | - * </init-param> |
48 | | - * </filter> |
| 41 | + * <filter> |
| 42 | + * <filter-name>ClickjackFilterSameOrigin</filter-name> |
| 43 | + * <filter-class>org.owasp.filters.ClickjackFilter</filter-class> |
| 44 | + * <init-param> |
| 45 | + * <param-name>mode</param-name> |
| 46 | + * <param-value>SAMEORIGIN</param-value> |
| 47 | + * </init-param> |
| 48 | + * </filter> |
49 | 49 | * |
50 | | - * <!-- use the Deny version to prevent anyone, including yourself, from framing the page --> |
51 | | - * <filter-mapping> |
52 | | - * <filter-name>ClickjackFilterDeny</filter-name> |
53 | | - * <url-pattern>/*</url-pattern> |
54 | | - * </filter-mapping> |
| 50 | + * <!-- use the Deny version to prevent anyone, including yourself, from framing the page --> |
| 51 | + * <filter-mapping> |
| 52 | + * <filter-name>ClickjackFilterDeny</filter-name> |
| 53 | + * <url-pattern>/*</url-pattern> |
| 54 | + * </filter-mapping> |
55 | 55 | * |
56 | | - * <!-- use the SameOrigin version to allow your application to frame, but nobody else |
57 | | - * <filter-mapping> |
58 | | - * <filter-name>ClickjackFilterSameOrigin</filter-name> |
59 | | - * <url-pattern>/*</url-pattern> |
60 | | - * </filter-mapping> |
| 56 | + * <!-- use the SameOrigin version to allow your application to frame, but nobody else |
| 57 | + * <filter-mapping> |
| 58 | + * <filter-name>ClickjackFilterSameOrigin</filter-name> |
| 59 | + * <url-pattern>/*</url-pattern> |
| 60 | + * </filter-mapping> |
61 | 61 | * </pre> |
| 62 | + * |
| 63 | + * @see <a href="https://web.archive.org/web/20131020084831/https://www.owasp.org/index.php/ClickjackFilter_for_Java_EE"> |
| 64 | + * OWASP - Clickjacking Filter for JavaEE</a> |
| 65 | + * @see <a href="https://owasp.org/www-community/attacks/Clickjacking">OWASP - Clickjacking Attack</a> |
| 66 | + * @see <a href="https://cheatsheetseries.owasp.org/cheatsheets/Clickjacking_Defense_Cheat_Sheet.html"> |
| 67 | + * OWASP - Clickjacking Defense Cheat Sheet</a> |
62 | 68 | */ |
63 | 69 | public class ClickjackFilter implements Filter |
64 | 70 | { |
|
0 commit comments