Skip to content

Commit 8b8baff

Browse files
dschadowdschadow
committed
Added sample project showing HSTS usage in a servlet filter
1 parent 6e24345 commit 8b8baff

8 files changed

Lines changed: 177 additions & 0 deletions

File tree

‎Ch05_HSTS/pom.xml‎

Lines changed: 50 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,50 @@
1+
<?xml version="1.0" encoding="UTF-8"?>
2+
<project xmlns="http://maven.apache.org/POM/4.0.0"
3+
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
4+
xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
5+
<modelVersion>4.0.0</modelVersion>
6+
<parent>
7+
<artifactId>javawebsecurity</artifactId>
8+
<groupId>de.dominikschadow.javawebsecurity</groupId>
9+
<version>1.0.0</version>
10+
</parent>
11+
<artifactId>Ch05_HSTS</artifactId>
12+
<packaging>war</packaging>
13+
<name>Ch05_HSTS</name>
14+
<url>https://github.com/dschadow/Java-Web-Security</url>
15+
16+
<dependencies>
17+
<dependency>
18+
<groupId>log4j</groupId>
19+
<artifactId>log4j</artifactId>
20+
</dependency>
21+
<dependency>
22+
<groupId>javax.servlet</groupId>
23+
<artifactId>javax.servlet-api</artifactId>
24+
<version>3.0.1</version>
25+
</dependency>
26+
</dependencies>
27+
28+
<build>
29+
<finalName>Ch05_HSTS</finalName>
30+
<defaultGoal>tomcat7:run-war</defaultGoal>
31+
<plugins>
32+
<plugin>
33+
<artifactId>maven-compiler-plugin</artifactId>
34+
</plugin>
35+
<plugin>
36+
<groupId>org.apache.tomcat.maven</groupId>
37+
<artifactId>tomcat7-maven-plugin</artifactId>
38+
</plugin>
39+
<plugin>
40+
<groupId>org.apache.maven.plugins</groupId>
41+
<artifactId>maven-war-plugin</artifactId>
42+
<configuration>
43+
<failOnMissingWebXml>false</failOnMissingWebXml>
44+
</configuration>
45+
</plugin>
46+
</plugins>
47+
</build>
48+
49+
50+
</project>

‎Ch05_HSTS/src/main/java/de/dominikschadow/webappsecurity/filter/HSTSFilter.java‎

Lines changed: 56 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,56 @@
1+
/*
2+
* Copyright (C) 2013 Dominik Schadow, [email protected]
3+
*
4+
* This file is part of Java-Web-Security
5+
.
6+
*
7+
* Licensed under the Apache License, Version 2.0 (the "License");
8+
* you may not use this file except in compliance with the License.
9+
* You may obtain a copy of the License at
10+
*
11+
* http://www.apache.org/licenses/LICENSE-2.0
12+
*
13+
* Unless required by applicable law or agreed to in writing, software
14+
* distributed under the License is distributed on an "AS IS" BASIS,
15+
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
16+
* See the License for the specific language governing permissions and
17+
* limitations under the License.
18+
*/
19+
package de.dominikschadow.webappsecurity.filter;
20+
21+
import org.apache.log4j.Logger;
22+
23+
import javax.servlet.*;
24+
import javax.servlet.annotation.WebServlet;
25+
import javax.servlet.http.HttpServlet;
26+
import javax.servlet.http.HttpServletRequest;
27+
import javax.servlet.http.HttpServletResponse;
28+
import javax.servlet.http.HttpSession;
29+
import java.io.IOException;
30+
import java.io.PrintWriter;
31+
32+
/**
33+
* Filter to add the <code>Strict-Transport-Security</code> header to every response.
34+
*
35+
* @author Dominik Schadow
36+
*/
37+
public class HSTSFilter implements Filter {
38+
private static final Logger LOGGER = Logger.getLogger(HSTSFilter.class);
39+
40+
@Override
41+
public void init(FilterConfig filterConfig) throws ServletException {
42+
LOGGER.info("HSTSFilter init");
43+
}
44+
45+
@Override
46+
public void doFilter(ServletRequest req, ServletResponse res, FilterChain chain) throws IOException, ServletException {
47+
((HttpServletResponse) res).setHeader("Strict-Transport-Security", "max-age=12960000; includeSubdomains");
48+
LOGGER.info("Added Strict-Transport-Security header to response");
49+
50+
chain.doFilter(req, res);
51+
}
52+
53+
@Override
54+
public void destroy() {
55+
}
56+
}

‎Ch05_HSTS/src/main/resources/log4j.xml‎

Lines changed: 15 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,15 @@
1+
<?xml version="1.0" encoding="UTF-8" ?>
2+
<!DOCTYPE log4j:configuration SYSTEM "log4j.dtd">
3+
<log4j:configuration xmlns:log4j="http://jakarta.apache.org/log4j/">
4+
<appender name="console" class="org.apache.log4j.ConsoleAppender">
5+
<param name="Target" value="System.out"/>
6+
<layout class="org.apache.log4j.PatternLayout">
7+
<param name="ConversionPattern" value="%-5p %c{1} - %m%n"/>
8+
</layout>
9+
</appender>
10+
11+
<root>
12+
<priority value="info"/>
13+
<appender-ref ref="console"/>
14+
</root>
15+
</log4j:configuration>

‎Ch05_HSTS/src/main/webapp/WEB-INF/web.xml‎

Lines changed: 17 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,17 @@
1+
<?xml version="1.0" encoding="UTF-8"?>
2+
<web-app xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns="http://java.sun.com/xml/ns/javaee"
3+
xsi:schemaLocation="http://java.sun.com/xml/ns/javaee http://java.sun.com/xml/ns/javaee/web-app_3_0.xsd"
4+
id="HSTS" version="3.0">
5+
<display-name>HSTS</display-name>
6+
<filter>
7+
<filter-name>HSTSFilter</filter-name>
8+
<filter-class>de.dominikschadow.webappsecurity.filter.HSTSFilter</filter-class>
9+
</filter>
10+
<filter-mapping>
11+
<filter-name>HSTSFilter</filter-name>
12+
<url-pattern>/*</url-pattern>
13+
</filter-mapping>
14+
<welcome-file-list>
15+
<welcome-file>index.html</welcome-file>
16+
</welcome-file-list>
17+
</web-app>

‎Ch05_HSTS/src/main/webapp/index.html‎

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,11 @@
1+
<html>
2+
<head>
3+
<meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
4+
<link rel="stylesheet" type="text/css" href="styles.css" />
5+
<title>Ch05_HSTS</title>
6+
</head>
7+
<body>
8+
<h1>Ch05_HSTS</h1>
9+
10+
</body>
11+
</html>

‎Ch05_HSTS/src/main/webapp/styles.css‎

Lines changed: 22 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,22 @@
1+
.text-input {
2+
width: 250px;
3+
}
4+
5+
h1 {
6+
font-size: 150%;
7+
}
8+
9+
h2 {
10+
font-size: 125%;
11+
}
12+
13+
td {
14+
font-size: 115%;
15+
}
16+
17+
th {
18+
background-color: darkgrey;
19+
padding: 2pt;
20+
font-weight: bold;
21+
font-size: 125%;
22+
}

‎README.md‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -30,6 +30,11 @@ Web application using Java Server Faces (JSF) to show the difference between usi
3030

3131
**Requirements:** Apache Tomcat, Webbrowser
3232

33+
###Ch05_HSTS
34+
Web application using a Servlet filter to add the *Strict-Transport-Security* header to each response.
35+
36+
**Requirements:** Apache Tomcat, Webbrowser
37+
3338
###Ch05_SessionFixation
3439
Web application invalidating an existing session and its session id before continuing in the login process. This web application requires the included special *context.xml* configuration for Tomcat in order to display the current session id via JavaScript.
3540

‎pom.xml‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -113,5 +113,6 @@
113113
<module>Ch07_XSSFilter</module>
114114
<module>Ch07_XSSJSF</module>
115115
<module>Ch08_CSRF</module>
116+
<module>Ch05_HSTS</module>
116117
</modules>
117118
</project>

0 commit comments

Comments
 (0)