<html><head>
      <meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1">
   <title>Header Filter</title><link rel="stylesheet" type="text/css" href="css/docbook.css"><meta name="generator" content="DocBook XSL Stylesheets V1.79.1"><meta name="keywords" content="jetty, servlet, servlet-api, cometd, http, websocket, eclipse, maven, java, server, software"><link rel="home" href="index.html" title="Jetty"><link rel="up" href="advanced-extras.html" title="Chapter&nbsp;18.&nbsp;Provided Servlets, Filters, and Handlers"><link rel="prev" href="dos-filter.html" title="Denial of Service Filter"><link rel="next" href="gzip-filter.html" title="Gzip Handler"><link xmlns:jfetch="java:org.eclipse.jetty.xslt.tools.JavaSourceFetchExtension" xmlns:fetch="java:org.eclipse.jetty.xslt.tools.SourceFetchExtension" xmlns:d="http://docbook.org/ns/docbook" xmlns:l="http://docbook.sourceforge.net/xmlns/l10n/1.0" xmlns:xslthl="http://xslthl.sf.net" xmlns:gcse="http://www.google.com" xmlns:date="http://exslt.org/dates-and-times" rel="shortcut icon" href="images/favicon.ico"><link rel="stylesheet" href="css/highlighter/foundation.css"><script src="js/highlight.pack.js"></script><script>
      hljs.initHighlightingOnLoad();
    </script><link type="text/css" rel="stylesheet" href="css/font-awesome/font-awesome.min.css"></head><body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF"><table xmlns:jfetch="java:org.eclipse.jetty.xslt.tools.JavaSourceFetchExtension" xmlns:fetch="java:org.eclipse.jetty.xslt.tools.SourceFetchExtension" xmlns:d="http://docbook.org/ns/docbook" xmlns:l="http://docbook.sourceforge.net/xmlns/l10n/1.0" xmlns:xslthl="http://xslthl.sf.net" xmlns:gcse="http://www.google.com" xmlns:date="http://exslt.org/dates-and-times"><tr><td style="width: 25%"><a href="http://www.eclipse.org/jetty"><img src="images/jetty-header-logo.png" alt="Jetty Logo"></a><br><span style="font-size: small">
            Version: 9.4.28-SNAPSHOT</span></td><td style="width: 50%"></td></tr></table><div xmlns:jfetch="java:org.eclipse.jetty.xslt.tools.JavaSourceFetchExtension" xmlns:fetch="java:org.eclipse.jetty.xslt.tools.SourceFetchExtension" xmlns:d="http://docbook.org/ns/docbook" xmlns:l="http://docbook.sourceforge.net/xmlns/l10n/1.0" xmlns:xslthl="http://xslthl.sf.net" xmlns:gcse="http://www.google.com" xmlns:date="http://exslt.org/dates-and-times" class="navheader"><table width="100%" summary="Navigation header"><tr><th colspan="3" align="center">Header Filter</th></tr><tr><td width="20%" align="left"><a accesskey="p" href="dos-filter.html"><i class="fa fa-chevron-left" aria-hidden="true"></i> Previous</a>&nbsp;</td><th width="60%" align="center">Chapter&nbsp;18.&nbsp;Provided Servlets, Filters, and Handlers<br><a accesskey="p" href="index.html"><i class="fa fa-home" aria-hidden="true"></i> Home</a></th><td width="20%" align="right">&nbsp;<a accesskey="n" href="gzip-filter.html">Next <i class="fa fa-chevron-right" aria-hidden="true"></i></a></td></tr></table><hr></div><div xmlns:jfetch="java:org.eclipse.jetty.xslt.tools.JavaSourceFetchExtension" xmlns:fetch="java:org.eclipse.jetty.xslt.tools.SourceFetchExtension" xmlns:d="http://docbook.org/ns/docbook" xmlns:l="http://docbook.sourceforge.net/xmlns/l10n/1.0" xmlns:xslthl="http://xslthl.sf.net" xmlns:gcse="http://www.google.com" xmlns:date="http://exslt.org/dates-and-times" class="jetty-callout"><h5 class="callout"><a href="http://www.webtide.com/">Contact the core Jetty developers at
          <span class="website">www.webtide.com</span></a></h5><p>
 private support for your internal/customer projects ... custom extensions and distributions ... versioned snapshots for indefinite support ...
 scalability guidance for your apps and Ajax/Comet projects ... development services for sponsored feature development
      </p></div><div class="section"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="header-filter"></a>Header Filter</h2></div></div></div><div class="toc"><dl class="toc"><dt><span class="section"><a href="header-filter.html#header-filter-metadata">Info</a></span></dt><dt><span class="section"><a href="header-filter.html#header-filter-usage">Usage</a></span></dt></dl></div><div class="section"><div class="titlepage"><div><div><h3 class="title"><a name="header-filter-metadata"></a>Info</h3></div></div></div><div class="itemizedlist"><ul class="itemizedlist" style="list-style-type: disc; "><li class="listitem">Classname: <code class="literal">org.eclipse.jetty.servlets.HeaderFilter</code></li><li class="listitem">Maven Artifact: org.eclipse.jetty:jetty-servlets</li><li class="listitem">Javadoc: <a class="link" href="http://www.eclipse.org/jetty/javadoc/9.4.28-SNAPSHOT/org/eclipse/jetty/servlets/HeaderFilter.html" target="_top">http://www.eclipse.org/jetty/javadoc/9.4.28-SNAPSHOT/org/eclipse/jetty/servlets/HeaderFilter.html</a></li></ul></div></div><div class="section"><div class="titlepage"><div><div><h3 class="title"><a name="header-filter-usage"></a>Usage</h3></div></div></div><p>The header filter sets or adds headers to each response based on an optionally included/excluded list of path specs, mime types, and/or HTTP methods.
This filter processes its configured headers before calling <code class="literal">doFilter</code> in the filter chain. Some of the headers configured in this filter may get overwritten by other filters and/or the servlet processing the request.</p><div class="section"><div class="titlepage"><div><div><h4 class="title"><a name="_required_jars_3"></a>Required JARs</h4></div></div></div><p>To use the Header Filter, these JAR files must be available in WEB-INF/lib:</p><div class="itemizedlist"><ul class="itemizedlist" style="list-style-type: disc; "><li class="listitem">$JETTY_HOME/lib/jetty-http.jar</li><li class="listitem">$JETTY_HOME/lib/jetty-servlets.jar</li><li class="listitem">$JETTY_HOME/lib/jetty-util.jar</li></ul></div></div><div class="section"><div class="titlepage"><div><div><h4 class="title"><a name="_sample_configuration_3"></a>Sample Configuration</h4></div></div></div><p>Place the configuration in a webapp&#8217;s <code class="literal">web.xml</code> or <code class="literal">jetty-web.xml</code>.
This filter will perform the following actions on each response:</p><div class="itemizedlist"><ul class="itemizedlist" style="list-style-type: disc; "><li class="listitem">Set the X-Frame-Options header to DENY.</li><li class="listitem">Add a Cache-Control header containing no-cache, no-store, must-revalidate</li><li class="listitem">Set the Expires header to approximately one year in the future.</li><li class="listitem">Add a Date header with the current system time.</li></ul></div><div class="blockquote"><blockquote class="blockquote"><div xmlns:jfetch="java:org.eclipse.jetty.xslt.tools.JavaSourceFetchExtension" xmlns:fetch="java:org.eclipse.jetty.xslt.tools.SourceFetchExtension" xmlns:d="http://docbook.org/ns/docbook" xmlns:l="http://docbook.sourceforge.net/xmlns/l10n/1.0" xmlns:xslthl="http://xslthl.sf.net" xmlns:gcse="http://www.google.com" xmlns:date="http://exslt.org/dates-and-times" class="note" style="margin-left: 0.5in; margin-right: 0.5in;"><h3 class="title"><i class="fa fa-asterisk" aria-hidden="true"></i> Note</h3><p>Each action must be separated by a comma.</p></div></blockquote></div><pre xmlns:jfetch="java:org.eclipse.jetty.xslt.tools.JavaSourceFetchExtension" xmlns:fetch="java:org.eclipse.jetty.xslt.tools.SourceFetchExtension" xmlns:d="http://docbook.org/ns/docbook" xmlns:l="http://docbook.sourceforge.net/xmlns/l10n/1.0" xmlns:xslthl="http://xslthl.sf.net" xmlns:gcse="http://www.google.com" xmlns:date="http://exslt.org/dates-and-times"><code>&lt;filter&gt;
   &lt;filter-name&gt;HeaderFilter&lt;/filter-name&gt;
   &lt;filter-class&gt;org.eclipse.jetty.servlets.HeaderFilter&lt;/filter-class&gt;
   &lt;init-param&gt;
     &lt;param-name&gt;headerConfig&lt;/param-name&gt;
     &lt;param-value&gt;
      set X-Frame-Options: DENY,
      "add Cache-Control: no-cache, no-store, must-revalidate",
      setDate Expires: 31540000000,
      addDate Date: 0
     &lt;/param-value&gt;
   &lt;/init-param&gt;
 &lt;/filter&gt;</code></pre></div><div class="section"><div class="titlepage"><div><div><h4 class="title"><a name="header-filter-init"></a>Configuring Header Filter Parameters</h4></div></div></div><p>The following <code class="literal">init</code> parameters control the behavior of the filter:</p><div class="variablelist"><dl class="variablelist"><dt><span class="term">includedPaths</span></dt><dd>Optional. Comma separated values of included path specs.</dd><dt><span class="term">excludedPaths</span></dt><dd>Optional. Comma separated values of excluded path specs.</dd><dt><span class="term">includedMimeTypes</span></dt><dd>Optional. Comma separated values of included mime types. The mime type will be guessed from the extension at the end of the request URL if the content type has not been set on the response.</dd><dt><span class="term">excludedMimeTypes</span></dt><dd>Optional. Comma separated values of excluded mime types. The mime type will be guessed from the extension at the end of the request URL if the content type has not been set on the response.</dd><dt><span class="term">includedHttpMethods</span></dt><dd>Optional. Comma separated values of included http methods.</dd><dt><span class="term">excludedHttpMethods</span></dt><dd>Optional. Comma separated values of excluded http methods.</dd><dt><span class="term">headerConfig</span></dt><dd>Comma separated values of actions to perform on headers. The syntax for each action is <code class="literal">action headerName: headerValue</code>.</dd></dl></div><p>Supported header actions:</p><div class="itemizedlist"><ul class="itemizedlist" style="list-style-type: disc; "><li class="listitem"><code class="literal">set</code> - causes set <code class="literal">setHeader</code> to be called on the response</li><li class="listitem"><code class="literal">add</code> - causes set <code class="literal">addHeader</code> to be called on the response</li><li class="listitem"><code class="literal">setDate</code> - causes <code class="literal">setDateHeader</code> to be called on the response.</li><li class="listitem"><code class="literal">addDate</code> - causes <code class="literal">addDateHeader</code> to be called on the response.</li></ul></div><p>If <code class="literal">setDate</code> or <code class="literal">addDate</code> is used, <code class="literal">headerValue</code> should be the number of milliseconds to add to the current system time before writing the header value.</p><p>If a property is both included and excluded by the filter configuration, then it will be considered excluded.</p><p>Path spec rules:</p><div class="itemizedlist"><ul class="itemizedlist" style="list-style-type: disc; "><li class="listitem">If the spec starts with <code class="literal">^</code>, the spec is assumed to be a regex based path spec and will match with normal Java regex rules.</li><li class="listitem">If the spec starts with <code class="literal">/</code>, the spec is assumed to be a Servlet url-pattern rules path spec for either an exact match or prefix based match.</li><li class="listitem">If the spec starts with <code class="literal">*.</code>, the spec is assumed to be a Servlet url-pattern rules path spec for a suffix based match.</li><li class="listitem">All other syntaxes are unsupported.</li></ul></div></div></div></div><script type="text/javascript">
      SyntaxHighlighter.all()
    </script><div class="navfooter"><hr><table width="100%" summary="Navigation footer"><tr><td width="40%" align="left"><a accesskey="p" href="dos-filter.html"><i class="fa fa-chevron-left" aria-hidden="true"></i> Previous</a>&nbsp;</td><td width="20%" align="center"><a accesskey="u" href="advanced-extras.html"><i class="fa fa-chevron-up" aria-hidden="true"></i> Top</a></td><td width="40%" align="right">&nbsp;<a accesskey="n" href="gzip-filter.html">Next <i class="fa fa-chevron-right" aria-hidden="true"></i></a></td></tr><tr><td width="40%" align="left" valign="top">Denial of Service Filter&nbsp;</td><td width="20%" align="center"><a accesskey="h" href="index.html"><i class="fa fa-home" aria-hidden="true"></i> Home</a></td><td width="40%" align="right" valign="top">&nbsp;Gzip Handler</td></tr></table></div><p xmlns:jfetch="java:org.eclipse.jetty.xslt.tools.JavaSourceFetchExtension" xmlns:fetch="java:org.eclipse.jetty.xslt.tools.SourceFetchExtension" xmlns:d="http://docbook.org/ns/docbook" xmlns:l="http://docbook.sourceforge.net/xmlns/l10n/1.0" xmlns:xslthl="http://xslthl.sf.net" xmlns:gcse="http://www.google.com" xmlns:date="http://exslt.org/dates-and-times"><div class="jetty-callout">
            See an error or something missing?
            <span class="callout"><a href="http://github.com/eclipse/jetty.project">Contribute to this documentation at
                <span class="website"><i class="fa fa-github" aria-hidden="true"></i> Github!</span></a></span><span style="float: right"><i>(Generated: 2020-03-10)</i></span></div></p></body></html>