title: Add HSTS feature to Tomcat
body: <p>Trust you all well.</p>
  
  <p>My web application run on tomcat 6.0.43 and do not use apache or nginx at front. </p>
  
  <p>I'm already enforce my web from http redirect to https using:</p>
  
  <ol>
  <li>URL Redirect at ../webapps/ROOT/index.jsp</li>
  </ol>
  
  <p><code>&lt;% response.sendRedirect("https://www.epi.com.my/portal/"); %&gt;</code></p>
  
  <ol start="2">
  <li>../webapps/myapp/WEB-INF/web.xml</li>
  </ol>
  
  <blockquote>
  <pre><code>&lt;security-constraint&gt;
  &lt;web-resource-collection&gt;
    &lt;web-resource-name&gt;Protected Context&lt;/web-resource-name&gt;
       &lt;url-pattern&gt;/*&lt;/url-pattern&gt;
   &lt;/web-resource-collection&gt;
   &lt;user-data-constraint&gt;
      &lt;transport-guarantee&gt;CONFIDENTIAL&lt;/transport-guarantee&gt;
  &lt;/user-data-constraint&gt;&lt;/security-constraint&gt;
  </code></pre>
  </blockquote>
  
  <p>Where to add such code below </p>
  
  <blockquote>
    <p>Header add Strict-Transport-Security "max-age=15768000"</p>
  </blockquote>
  
  <p>OR 
  Is tomcat did not have this feature?
  Or I need to modify in every my java web app controller.</p>