How to enable HSTS (HTTP Strict Transport Security) in Tomcat + JIRA -

it helpful if suggest me enable hsts(http strict transport security) header in tomcat

my jira application running on tomcat , there no apache or nginx @ front.

i set hsts response header jira application, kindly please suggest how can implement in tomcat.

thanks in advance.

i think you're looking for. took https://bz.apache.org/bugzilla/attachment.cgi?id=30003&action=edit

<filter>     <filter-name>hstsfilter</filter-name>     <filter-class>org.apache.catalina.filters.hstsfilter</filter-class>     <init-param>        <param-name>maxageseconds</param-name>        <param-value>31536000</param-value>     </init-param>     <init-param>        <param-name>includesubdomains</param-name>        <param-value>true</param-value>     </init-param> </filter> <filter-mapping>     <filter-name>hstsfilter</filter-name>     <url-pattern>/*</url-pattern> </filter-mapping>  package org.apache.catalina.filters;  import java.io.ioexception;  import javax.servlet.filterchain; import javax.servlet.filterconfig; import javax.servlet.servletexception; import javax.servlet.servletrequest; import javax.servlet.servletresponse; import javax.servlet.http.httpservletresponse;  import org.apache.juli.logging.log; import org.apache.juli.logging.logfactory;  public class hstsfilter extends filterbase {     private static final string header_name = "strict-transport-security";     private static final string max_age_directive = "max-age=%s";     private static final string include_sub_domains_directive = "includesubdomains";      private static final log log = logfactory.getlog(hstsfilter.class);      // default "0" recommended in section 11.2 of rfc 6797     private int maxageseconds = 0;     private boolean includesubdomains = false;      private string directives;      public void setmaxageseconds(int maxageseconds) {         this.maxageseconds = maxageseconds;     }      public void setincludesubdomains(boolean includesubdomains) {         this.includesubdomains = includesubdomains;     }      @override     public void dofilter(servletrequest request, servletresponse response,             filterchain chain) throws ioexception, servletexception {         chain.dofilter(request, response);          // note hsts header must not included in http responses         // conveyed on non-secure transport         if (request.issecure() && response instanceof httpservletresponse) {             httpservletresponse res = (httpservletresponse) response;             res.addheader(header_name, this.directives);         }     }      @suppresswarnings("boxing")     @override     public void init(filterconfig filterconfig) throws servletexception {         super.init(filterconfig);         if (this.maxageseconds < 0) {             throw new servletexception(sm.getstring(                     "hsts.invalidparametervalue", this.maxageseconds,                     "maxageseconds"));         }         this.directives = string.format(max_age_directive, this.maxageseconds);         if (this.includesubdomains) {             this.directives += (" ; " + include_sub_domains_directive);         }     }      @override     protected log getlogger() {         return log;     } } 

check code on link i've attached.