Tomcat 啟用HSTS 功能

server.xml

XML

<Connector port="8080" protocol="HTTP/1.1"
               connectionTimeout="20000"
               redirectPort="8443" />

<Connector port="443" protocol="HTTP/1.1" SSLEnabled="true"
				maxThreads="150" scheme="https" secure="true"
				keystoreFile="C:/apache-tomcat-9.0.65/ssl_key/keystore.jks" keystorePass="your_password"
				clientAuth="false" sslProtocol="TLS">
	</Connector>

web.xml

XML

<filter>
        <filter-name>httpHeaderSecurity</filter-name>
        <filter-class>org.apache.catalina.filters.HttpHeaderSecurityFilter</filter-class>
        <async-supported>true</async-supported>
		<init-param>
			<param-name>hstsEnabled</param-name>
			<param-value>true</param-value>
		</init-param>
		<init-param>
			<param-name>hstsMaxAgeSeconds</param-name>
			<param-value>31556927</param-value>
		</init-param>
		<init-param>
			<param-name>hstsIncludeSubDomains</param-name>
			<param-value>true</param-value>
		</init-param>
    </filter>