title: configuring Content-Security-Policy in tomcat
body: <p>I read about configuring/implementing Content-Security-Policy header and I came accross 2 ways of doing it:</p>
  
  <ol>
  <li>using custom filter that implements Filter as given in <a href="https://stackoverflow.com/questions/37306300/can-tomcat-7-be-configured-to-insert-content-security-policy-http-header">this</a> link</li>
  <li>using meta tag </li>
  </ol>
  
  <p>Please note that this question is not duplicate of <a href="https://stackoverflow.com/questions/37306300/can-tomcat-7-be-configured-to-insert-content-security-policy-http-header">this</a>, Iam looking for a solution better than given in <a href="https://stackoverflow.com/questions/37306300/can-tomcat-7-be-configured-to-insert-content-security-policy-http-header">this</a> link</p>
  
  <p>I see the drawbacks in (1) is its driven through code, not through a configuration file , drawbacks in option (2) is if I have say 100 html files, I need to put this tag in every HTML? (correct me if I'm wrong)
  The solution I'm looking for is something I can configure in web.xml and becomes applicable for all the html files. Something the way we do in case of configuring X-Frame-Options in web.xml like given <a href="https://stackoverflow.com/questions/34991226/xframe-option-in-tomcat-7">here</a>, don't we have similar way of configuring Content-Security-Policy in web.xml ?</p>