1+ <?xml version =" 1.0" ?>
2+ <!DOCTYPE Configure PUBLIC "-//Jetty//Configure//EN" "https://www.eclipse.org/jetty/configure_10_0.dtd">
3+
4+ <!-- Web applications and security headers configuration -->
5+ <Configure class =" org.eclipse.jetty.server.handler.ContextHandlerCollection" id =" Contexts" >
6+
7+ <!-- Rewrite Handler for Security Headers -->
8+ <Call name =" addHandler" >
9+ <Arg >
10+ <New class =" org.eclipse.jetty.rewrite.handler.RewriteHandler" >
11+ <Call name =" addRule" >
12+ <Arg >
13+ <New class =" org.eclipse.jetty.rewrite.handler.HeaderPatternRule" >
14+ <Set name =" pattern" >*</Set >
15+ <Set name =" headerName" >X-FRAME-OPTIONS</Set >
16+ <Set name =" headerValue" >SAMEORIGIN</Set >
17+ </New >
18+ </Arg >
19+ </Call >
20+ <Call name =" addRule" >
21+ <Arg >
22+ <New class =" org.eclipse.jetty.rewrite.handler.HeaderPatternRule" >
23+ <Set name =" pattern" >*</Set >
24+ <Set name =" headerName" >X-XSS-Protection</Set >
25+ <Set name =" headerValue" >1; mode=block</Set >
26+ </New >
27+ </Arg >
28+ </Call >
29+ <Call name =" addRule" >
30+ <Arg >
31+ <New class =" org.eclipse.jetty.rewrite.handler.HeaderPatternRule" >
32+ <Set name =" pattern" >*</Set >
33+ <Set name =" headerName" >X-Content-Type-Options</Set >
34+ <Set name =" headerValue" >nosniff</Set >
35+ </New >
36+ </Arg >
37+ </Call >
38+ <Call name =" addRule" >
39+ <Arg >
40+ <New class =" org.eclipse.jetty.rewrite.handler.HeaderPatternRule" >
41+ <Set name =" pattern" >*</Set >
42+ <Set name =" headerName" >Cache-Control</Set >
43+ <Set name =" headerValue" >no-store</Set >
44+ </New >
45+ </Arg >
46+ </Call >
47+ <Call name =" addRule" >
48+ <Arg >
49+ <New class =" org.eclipse.jetty.rewrite.handler.HeaderPatternRule" >
50+ <Set name =" pattern" >*</Set >
51+ <Set name =" headerName" >Content-Security-Policy</Set >
52+ <Set name =" headerValue" >style-src-elem 'self'; style-src 'self'; img-src 'self'; script-src-elem 'self'; default-src 'none'; object-src 'none'; frame-ancestors 'none'; base-uri 'none';</Set >
53+ </New >
54+ </Arg >
55+ </Call >
56+ <!-- Relaxed CSP rules for XML admin pages -->
57+ <Call name =" addRule" >
58+ <Arg >
59+ <New class =" org.eclipse.jetty.rewrite.handler.HeaderPatternRule" >
60+ <Set name =" pattern" >/admin/xml/*</Set >
61+ <Set name =" headerName" >Content-Security-Policy</Set >
62+ <Set name =" headerValue" >style-src-elem 'self' 'unsafe-inline'; style-src 'self'; img-src 'self' data:; script-src-elem 'self'; default-src 'none'; object-src 'none'; frame-ancestors 'none'; base-uri 'none';</Set >
63+ </New >
64+ </Arg >
65+ </Call >
66+ </New >
67+ </Arg >
68+ </Call >
69+
70+ <!-- Admin Web Application -->
71+ <Call name =" addHandler" >
72+ <Arg >
73+ <New class =" org.eclipse.jetty.ee9.webapp.WebAppContext" >
74+ <Set name =" contextPath" >/admin</Set >
75+ <Set name =" baseResourceAsString" >webapps/admin</Set >
76+ <Set name =" logUrlOnStart" >true</Set >
77+ </New >
78+ </Arg >
79+ </Call >
80+
81+ <!-- API Web Application -->
82+ <Call name =" addHandler" >
83+ <Arg >
84+ <New class =" org.eclipse.jetty.ee9.webapp.WebAppContext" >
85+ <Set name =" contextPath" >/api</Set >
86+ <Set name =" baseResourceAsString" >webapps/api</Set >
87+ <Set name =" logUrlOnStart" >true</Set >
88+ </New >
89+ </Arg >
90+ </Call >
91+
92+ <!-- Static Resource Handler -->
93+ <Call name =" addHandler" >
94+ <Arg >
95+ <New class =" org.eclipse.jetty.server.handler.ResourceHandler" >
96+ <!-- Set name="directoriesListed">false</Set -->
97+ <Set name =" welcomeFiles" >
98+ <Array type =" java.lang.String" >
99+ <Item >index.html</Item >
100+ </Array >
101+ </Set >
102+ <Set name =" baseResourceAsString" >webapps/</Set >
103+ </New >
104+ </Arg >
105+ </Call >
106+
107+ <!-- Default Handler -->
108+ <Call name =" addHandler" >
109+ <Arg >
110+ <New class =" org.eclipse.jetty.server.handler.DefaultHandler" >
111+ <Set name =" serveFavIcon" >false</Set >
112+ </New >
113+ </Arg >
114+ </Call >
115+
116+ </Configure >
0 commit comments