title: Enabling http strict transport security in tomcat 7
body: <p>I am trying to enable hsts in my application.I have modified my web.xml like this.This is WEB-INF web.xml and not inside tomcat</p>
  
  <p>web.xml</p>
  
  <pre><code>    &lt;filter&gt;
      &lt;filter-name&gt;httpHeaderSecurity&lt;/filter-name&gt;
      &lt;filter-class&gt;org.apache.catalina.filters.HttpHeaderSecurityFilter&lt;/filter-class&gt;
      &lt;init-param&gt;
      &lt;param-name&gt;hstsEnabled&lt;/param-name&gt;
      &lt;param-value&gt;true&lt;/param-value&gt;
      &lt;/init-param&gt; 
      &lt;init-param&gt;
      &lt;param-name&gt;maxAgeSeconds&lt;/param-name&gt;
     &lt;param-value&gt;31536000&lt;/param-value&gt;
     &lt;/init-param&gt;
    &lt;init-param&gt;
    &lt;param-name&gt;includeSubDomains&lt;/param-name&gt;
    &lt;param-value&gt;true&lt;/param-value&gt;
    &lt;/init-param&gt;
    &lt;async-supported&gt;true&lt;/async-supported&gt;
    &lt;init-param&gt;
        &lt;param-name&gt;antiClickJackingEnabled&lt;/param-name&gt;
        &lt;param-value&gt;true&lt;/param-value&gt;
      &lt;/init-param&gt;
      &lt;init-param&gt;
        &lt;param-name&gt;antiClickJackingOption&lt;/param-name&gt;
        &lt;param-value&gt;DENY&lt;/param-value&gt;
      &lt;/init-param&gt;
      &lt;/filter&gt;
      &lt;filter-mapping&gt; 
      &lt;filter-name&gt;httpHeaderSecurity&lt;/filter-name&gt; 
      &lt;url-pattern&gt;/*&lt;/url-pattern&gt;
      &lt;/filter-mapping&gt;
  </code></pre>
  
  <p>I am checking my website url with this test tool <a href="https://tools.geekflare.com" rel="nofollow noreferrer">https://tools.geekflare.com</a> but nothing is enabled.All are showing cross mark.But in the above configuration if i remove hsts thing that is if i deploy this below xml then X-XSS-Protection Header,X-Frame-Options Header Header,X-Content-Type-Options Header are enabled but not HTTP Strict Transport Security (HSTS) Header.</p>
  
  <pre><code>    &lt;filter&gt;
      &lt;filter-name&gt;httpHeaderSecurity&lt;/filter-name&gt;
      &lt;filter-class&gt;org.apache.catalina.filters.HttpHeaderSecurityFilter&lt;/filter-class&gt;
      &lt;async-supported&gt;true&lt;/async-supported&gt;
      &lt;init-param&gt;
        &lt;param-name&gt;antiClickJackingEnabled&lt;/param-name&gt;
        &lt;param-value&gt;true&lt;/param-value&gt;
      &lt;/init-param&gt;
      &lt;init-param&gt;
        &lt;param-name&gt;antiClickJackingOption&lt;/param-name&gt;
        &lt;param-value&gt;DENY&lt;/param-value&gt;
      &lt;/init-param&gt;
      &lt;/filter&gt;
    &lt;filter-mapping&gt; 
    &lt;filter-name&gt;httpHeaderSecurity&lt;/filter-name&gt; 
    &lt;url-pattern&gt;/*&lt;/url-pattern&gt;
    &lt;/filter-mapping&gt;
  </code></pre>
  
  <p>Can anyone tell how to enable HTTP Strict Transport Security (HSTS) Header? in tomcat 7?</p>