Fix bug 'X-Frame-Options not configured: Lack of clickjacking protection'
[sdc.git] / openecomp-be / api / openecomp-sdc-rest-webapp / onboarding-rest-war / src / main / webapp / WEB-INF / web.xml
1 <web-app
2     xmlns="http://java.sun.com/xml/ns/javaee"
3     xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
4     xsi:schemaLocation="http://java.sun.com/xml/ns/javaee http://java.sun.com/xml/ns/javaee/web-app_3_0.xsd"
5     version="3.0">
6
7     <!-- Spring -->
8     <context-param>
9         <param-name>contextConfigLocation</param-name>
10         <param-value>WEB-INF/beans-services.xml</param-value>
11     </context-param>
12
13     <context-param>
14         <param-name>org.togglz.core.manager.TogglzConfig</param-name>
15         <param-value>org.openecomp.sdc.be.togglz.TogglzConfiguration</param-value>
16     </context-param>
17
18     <context-param>
19         <param-name>org.eclipse.jetty.servlet.Default.dirAllowed</param-name>
20         <param-value>false</param-value>
21     </context-param>
22
23     <listener>
24         <listener-class>org.openecomp.server.listeners.OnboardingAppStartupListener</listener-class>
25     </listener>
26
27     <filter>
28         <filter-name>contentSecurityPolicyHeaderFilter</filter-name>
29         <filter-class>org.openecomp.sdc.common.filters.ContentSecurityPolicyHeaderFilter</filter-class>
30         <async-supported>true</async-supported>
31     </filter>
32     <filter-mapping>
33         <filter-name>contentSecurityPolicyHeaderFilter</filter-name>
34         <url-pattern>/*</url-pattern>
35     </filter-mapping>
36
37     <filter>
38         <filter-name>PermissionsFilter</filter-name>
39         <filter-class>org.openecomp.sdc.itempermissions.servlet.PermissionsFilter</filter-class>
40     </filter>
41     <filter-mapping>
42         <filter-name>PermissionsFilter</filter-name>
43         <url-pattern>/v1.0/vendor-license-models/*</url-pattern>
44     </filter-mapping>
45     <filter-mapping>
46         <filter-name>PermissionsFilter</filter-name>
47         <url-pattern>/v1.0/vendor-software-products/*</url-pattern>
48     </filter-mapping>
49
50     <filter>
51         <filter-name>cross-origin</filter-name>
52         <filter-class>org.eclipse.jetty.servlets.CrossOriginFilter</filter-class>
53         <init-param>
54             <param-name>allowedOrigins</param-name>
55             <param-value>*</param-value>
56         </init-param>
57         <init-param>
58             <param-name>allowedMethods</param-name>
59             <param-value>*</param-value>
60         </init-param>
61         <init-param>
62             <param-name>allowedHeaders</param-name>
63             <param-value>*</param-value>
64         </init-param>
65     </filter>
66
67     <filter>
68         <filter-name>RestrictionAccessFilter</filter-name>
69         <filter-class>org.openecomp.server.filters.RestrictionAccessFilter</filter-class>
70         <async-supported>true</async-supported>
71     </filter>
72     <filter-mapping>
73         <filter-name>RestrictionAccessFilter</filter-name>
74         <url-pattern>/*</url-pattern>
75     </filter-mapping>
76     <filter>
77         <filter-name>BasicAuth</filter-name>
78         <filter-class>org.openecomp.server.filters.BasicAuthenticationFilter</filter-class>
79     </filter>
80     <filter>
81         <filter-name>AuthN</filter-name>
82         <filter-class>org.openecomp.server.filters.ActionAuthenticationFilter</filter-class>
83     </filter>
84     <filter>
85         <filter-name>AuthZ</filter-name>
86         <filter-class>org.openecomp.server.filters.ActionAuthorizationFilter</filter-class>
87     </filter>
88     <filter-mapping>
89         <filter-name>cross-origin</filter-name>
90         <url-pattern>/*</url-pattern>
91     </filter-mapping>
92     <filter-mapping>
93         <filter-name>BasicAuth</filter-name>
94         <url-pattern>/1.0/*</url-pattern>
95     </filter-mapping>
96     <filter-mapping>
97         <filter-name>AuthN</filter-name>
98         <url-pattern>/workflow/v1.0/actions/*</url-pattern>
99     </filter-mapping>
100     <filter-mapping>
101         <filter-name>AuthZ</filter-name>
102         <url-pattern>/workflow/v1.0/actions/*</url-pattern>
103     </filter-mapping>
104     <filter>
105         <filter-name>SessionContextFilter</filter-name>
106         <filter-class>org.openecomp.server.filters.OnboardingSessionContextFilter</filter-class>
107     </filter>
108     <filter-mapping>
109         <filter-name>SessionContextFilter</filter-name>
110         <url-pattern>/*</url-pattern>
111     </filter-mapping>
112     <!-- Spring WS Mapping -->
113     <servlet>
114         <servlet-name>spring-mapper</servlet-name>
115         <servlet-class>
116             org.springframework.web.servlet.DispatcherServlet
117         </servlet-class>
118         <load-on-startup>1</load-on-startup>
119     </servlet>
120     <!-- CXF -->
121     <servlet>
122         <servlet-name>CXFServlet</servlet-name>
123         <servlet-class>
124             org.apache.cxf.transport.servlet.CXFServlet
125         </servlet-class>
126         <init-param>
127             <param-name>redirects-list</param-name>
128             <param-value>
129                 /docs/(\S)+\.json
130             </param-value>
131         </init-param>
132         <init-param>
133             <param-name>redirect-attributes</param-name>
134             <param-value>
135                 javax.servlet.include.request_uri
136             </param-value>
137         </init-param>
138         <init-param>
139             <param-name>redirect-servlet-name</param-name>
140             <param-value>default</param-value>
141         </init-param>
142         <load-on-startup>1</load-on-startup>
143     </servlet>
144     <servlet-mapping>
145         <servlet-name>spring-mapper</servlet-name>
146         <url-pattern>/ws/*</url-pattern>
147     </servlet-mapping>
148     <servlet-mapping>
149         <servlet-name>CXFServlet</servlet-name>
150         <url-pattern>/*</url-pattern>
151     </servlet-mapping>
152
153 </web-app>