Appendix C: Suggested Tomcat Configuration for Secure Titan Installation - Appendix C: Suggested Tomcat Configuration for Secure Titan Installation - Perceptive Content - Titan - Perceptive-Content/Titan/Foundation-26.1/Titan-Installation-and-Setup-Guide/Appendix-C-Suggested-Tomcat-Configuration-for-Secure-Titan-Installation - Foundation 26.1 - Foundation 26.1

This section describes the configuration for Apache Tomcat to prevent clickjacking at the server level by setting the X-Frame-Options header through the global web.xml. Setting values ensure that all applications that are deployed (such as Titan) inherit the defined security behavior automatically.

To secure Tomcat against clickjacking using the global filter, complete the following steps.

1. Stop the Tomcat instance.
2. Navigate to Tomcat installation directory.
3. In Tomcat installation directory, navigate to conf directory.
4. Open web.xml using a text editor.
5. In the text editor, scroll down before the </web-app> closing tag.
6. Add the following filter configuration.

   <filter>
       <filter-name>ClickjackingFilter</filter-name>
       <filter-class>org.apache.catalina.filters.HttpHeaderSecurityFilter</filter-class>
       <init-param>
           <param-name>antiClickJackingEnabled</param-name>
           <param-value>true</param-value>
       </init-param>
       <init-param>
           <param-name>antiClickJackingOption</param-name>
           <param-value>DENY</param-value> <!-- Options: SAMEORIGIN, ALLOW-FROM -->
       </init-param>
   </filter>
   
   <filter-mapping>
       <filter-name>ClickjackingFilter</filter-name>
       <url-pattern>/*</url-pattern>
   </filter-mapping>

   The options associated with filter are:

   • DENY: No page is displayed in a frame. This is the most secured option.
   • SAMEORIGIN: Allows Titan to be accessed within current domain. This option prevents Titan from being embedded in an <iframe> or <frame> on any domain other than itself.
   • ALLOW-FROM https://example.com: This option allows the page from the specified domain.
7. Restart Tomcat.