Fix for Penetration test _ Session and cookie management
[vid.git] / epsdk-app-onap / src / main / webapp / WEB-INF / web.xml
1 <?xml version="1.0" encoding="UTF-8"?>\r
2 <web-app xmlns="http://xmlns.jcp.org/xml/ns/javaee"\r
3          xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"\r
4          xsi:schemaLocation="http://xmlns.jcp.org/xml/ns/javaee http://xmlns.jcp.org/xml/ns/javaee/web-app_3_1.xsd"\r
5          version="3.1">\r
6         <display-name>ecomp-sdk-app-os</display-name>\r
7 \r
8         <!-- The app can function on a HA cluster -->\r
9         <distributable />\r
10 \r
11         <session-config>\r
12                 <session-timeout>30</session-timeout>\r
13                 <tracking-mode>COOKIE</tracking-mode>\r
14         </session-config>\r
15 \r
16         <filter>\r
17     <filter-name>SecurityXssFilter</filter-name>\r
18     <filter-class>org.onap.portalapp.filter.SecurityXssFilter</filter-class>\r
19    </filter> \r
20     <filter-mapping>\r
21     <filter-name>SecurityXssFilter</filter-name>\r
22     <url-pattern>/*</url-pattern>\r
23   </filter-mapping>\r
24 \r
25   <!--\r
26   `vid-webpack-master` servlet and it's servlet mapping below, serves\r
27   Angular's index.html for any requests like the following, letting\r
28   the JavaScript router do its magic:\r
29   * /vid/app/ui/\r
30   * /vid/app/ui/servicePlanning\r
31   * /vid/app/ui/browseSdc\r
32   -->\r
33   <servlet>\r
34     <servlet-name>vid-webpack-master</servlet-name>\r
35     <jsp-file>/app/ui/index.html</jsp-file>\r
36   </servlet>\r
37 \r
38   <servlet-mapping>\r
39     <servlet-name>vid-webpack-master</servlet-name>\r
40     <url-pattern>/app/ui/</url-pattern>\r
41   </servlet-mapping>\r
42 \r
43   <!--\r
44   All the files under the paths below are served as static files, using\r
45   tomcat's `default` servlet. This overrides the `vid-webpack-master`\r
46   url-pattern.\r
47   The filter `charset-to-utf8-filter` adds "charset=UTF-8" to these files\r
48   content type, as the default content-type is platform-dependant (which\r
49   is not ok for Windows stations).\r
50   -->\r
51   <servlet-mapping>\r
52     <servlet-name>default</servlet-name>\r
53     <url-pattern>/app/ui/*</url-pattern>\r
54   </servlet-mapping>\r
55 \r
56   <filter>\r
57     <filter-name>charset-to-utf8-filter</filter-name>\r
58     <filter-class>org.springframework.web.filter.CharacterEncodingFilter</filter-class>\r
59     <init-param>\r
60       <param-name>encoding</param-name>\r
61       <param-value>UTF-8</param-value>\r
62     </init-param>\r
63     <init-param>\r
64       <param-name>forceEncoding</param-name>\r
65       <param-value>true</param-value>\r
66     </init-param>\r
67   </filter>\r
68 \r
69   <filter-mapping>\r
70     <filter-name>charset-to-utf8-filter</filter-name>\r
71     <url-pattern>/app/ui/*</url-pattern>\r
72   </filter-mapping>\r
73       <filter>\r
74     <filter-name>httpHeaderSecurity</filter-name>\r
75     <filter-class>org.apache.catalina.filters.HttpHeaderSecurityFilter</filter-class>\r
76     <async-supported>true</async-supported>\r
77     <init-param>\r
78       <param-name>antiClickJackingEnabled</param-name>\r
79       <param-value>true</param-value>\r
80     </init-param>\r
81     <init-param>\r
82       <param-name>antiClickJackingOption</param-name>\r
83       <param-value>DENY</param-value>\r
84     </init-param>\r
85   </filter>\r
86   <filter-mapping>\r
87     <filter-name>httpHeaderSecurity</filter-name>\r
88     <url-pattern>/*</url-pattern>\r
89   </filter-mapping>\r
90 \r
91   <error-page>\r
92     <error-code>404</error-code>\r
93     <location>/vid/epsdk-app-onap/src/main/webapp/WEB-INF/jsp/errorPage.jsp</location>\r
94   </error-page>\r
95 </web-app>