title: X-Frame-Options header is not included in the HTTP response for ajax4jsf and richfaces
body: <p>For security reason, X-Frame options must be included in http responses of my application. I created a filter class to add X-Frmae-OPTIONS to response.  The x-frame- options included in all app pages, with exception, ajax4jsf/framework.pack.js and richfaces/skin.xcss. These two files show as security risk and x-frame-options is not included.
  We are using richface3.3 and Seams and JSF1.2 and java, weblogic12c. 
  I'm using OWASP ZAP to scan the application </p>
  
  <p>My questions:  </p>
  
  <ol>
  <li>Why filter class is ignored? There is a way I can change it?</li>
  <li>does the upgrade (richface, seams and jsf, etc) resolve this issue? Any other solution?</li>
  </ol>
  
  <p>Thank you for your help</p>
  
  <pre><code> public class XSSFilter implements Filter { 
  
   public void doFilter(ServletRequest request, ServletResponse response,
            FilterChain chain) throws IOException, ServletException {
     String mode = "SAMEORIGIN";
     //String mode = "DENY";
     HttpServletResponse res = (HttpServletResponse)response;
     HttpServletRequest req = (HttpServletRequest) request;        
  
      //Clickjacking protection 
     res.setHeader("X-FRAME-OPTIONS", mode);
     res.setHeader("X-XSS-Protection", "1; mode=block");
      chain.doFilter(request, res); 
  
  
     }
  
     public void destroy() {
     }
  
     public void init(FilterConfig filterConfig)  throws ServletException {
     }
  
   }
  </code></pre>