在WSO2AM-4.0.0中添加STS、CSP及Referer安全头的问题求助

你遇到的问题核心在于：直接修改web.xml会被WSO2的配置映射器重写，而单一的tomcat.carbon.filter配置仅对DevPortal生效。以下是两种可靠的解决方式：

方法一：通过deployment.toml全局配置（推荐） #

这种方式无需修改模板文件，直接通过配置文件统一为所有门户添加安全头，且不会被重写。

1. 配置HSTS（STS）安全头 #

使用Tomcat内置的HttpHeaderSecurityFilter实现HSTS，添加到deployment.toml：

# 全局生效的HSTS过滤器，应用到所有Web门户
[[tomcat.webapp.filter]]
name = "HttpHeaderSecurityFilter"
class = "org.apache.catalina.filters.HttpHeaderSecurityFilter"
[tomcat.webapp.filter.init_params]
hstsMaxAgeSeconds = "15768000"
hstsIncludeSubDomains = "true" # 可选，根据安全需求启用子域名包含

# 映射过滤器到所有URL路径
[[tomcat.webapp.filter_mapping]]
name = "HttpHeaderSecurityFilter"
url_pattern = ["/*"]
dispatcher = ["REQUEST"]

2. 添加自定义过滤器处理CSP和Referer-Policy #

由于HttpHeaderSecurityFilter不支持CSP和Referer-Policy，需要自定义一个简单的过滤器：

• 编写Java过滤器类：

package com.wso2.security;

import javax.servlet.*;
import javax.servlet.http.HttpServletResponse;
import java.io.IOException;

public class CustomSecurityHeaderFilter implements Filter {
    private String cspValue;
    private String refererPolicyValue;

    @Override
    public void init(FilterConfig config) throws ServletException {
        cspValue = config.getInitParameter("contentSecurityPolicy");
        refererPolicyValue = config.getInitParameter("refererPolicy");
    }

    @Override
    public void doFilter(ServletRequest req, ServletResponse res, FilterChain chain) throws IOException, ServletException {
        HttpServletResponse response = (HttpServletResponse) res;
        if (cspValue != null) {
            response.setHeader("Content-Security-Policy", cspValue);
        }
        if (refererPolicyValue != null) {
            response.setHeader("Referrer-Policy", refererPolicyValue);
        }
        chain.doFilter(req, res);
    }

    @Override
    public void destroy() {}
}

• 将编译后的类打包成JAR，放入<APIM_HOME>/repository/components/lib目录
• 在deployment.toml中添加全局配置：

[[tomcat.webapp.filter]]
name = "CustomSecurityHeaderFilter"
class = "com.wso2.security.CustomSecurityHeaderFilter"
[tomcat.webapp.filter.init_params]
contentSecurityPolicy = "default-src 'self'; script-src 'self' 'unsafe-inline'; style-src 'self' 'unsafe-inline';" # 根据安全规则调整
refererPolicy = "strict-origin-when-cross-origin" # 可选值：no-referrer、same-origin等

[[tomcat.webapp.filter_mapping]]
name = "CustomSecurityHeaderFilter"
url_pattern = ["/*"]
dispatcher = ["REQUEST"]

方法二：修改Web应用模板文件 #

通过修改WSO2的web.xml模板，确保所有门户生成的web.xml都包含安全头过滤器配置：

1. 打开<APIM_HOME>/repository/resources/templates/webapp/WEB-INF/web.xml.j2
2. 在<filter>标签区域添加以下配置：

<!-- HSTS安全头配置 -->
<filter>
    <filter-name>HttpHeaderSecurityFilter</filter-name>
    <filter-class>org.apache.catalina.filters.HttpHeaderSecurityFilter</filter-class>
    <init-param>
        <param-name>hstsMaxAgeSeconds</param-name>
        <param-value>15768000</param-value>
    </init-param>
    <init-param>
        <param-name>hstsIncludeSubDomains</param-name>
        <param-value>true</param-value>
    </init-param>
</filter>

<!-- CSP和Referer-Policy安全头配置 -->
<filter>
    <filter-name>CustomSecurityHeaderFilter</filter-name>
    <filter-class>com.wso2.security.CustomSecurityHeaderFilter</filter-class>
    <init-param>
        <param-name>contentSecurityPolicy</param-name>
        <param-value>default-src 'self'; script-src 'self' 'unsafe-inline'; style-src 'self' 'unsafe-inline';</param-value>
    </init-param>
    <init-param>
        <param-name>refererPolicy</param-name>
        <param-value>strict-origin-when-cross-origin</param-value>
    </init-param>
</filter>

<!-- 过滤器映射 -->
<filter-mapping>
    <filter-name>HttpHeaderSecurityFilter</filter-name>
    <url-pattern>/*</url-pattern>
    <dispatcher>REQUEST</dispatcher>
</filter-mapping>
<filter-mapping>
    <filter-name>CustomSecurityHeaderFilter</filter-name>
    <url-pattern>/*</url-pattern>
    <dispatcher>REQUEST</dispatcher>
</filter-mapping>

3. 放入自定义Filter的JAR包到<APIM_HOME>/repository/components/lib
4. 重启WSO2 AM，所有门户的web.xml会根据模板生成，配置不会被重写

验证生效 #

重启服务后，访问Admin Portal、Publisher、DevPortal，通过浏览器开发者工具查看响应头，确认Strict-Transport-Security、Content-Security-Policy、Referrer-Policy是否正确出现。

内容的提问来源于stack exchange，提问作者Wanjalize