This one escaped me for a long time and I never saw a decent example of it in any of the documentation.
GZip compression saves on network bandwidth as files are compressed during transport between the HTTP Server and browser/client. If you already use Apache HTTP or a similar webserver to front Tomcat, this is not always necessary, but in cases where you expose your appserver directly, even if it is just for testing, you may want to add this configuration item as it increases the perceived speed of the application.
The solution is simple:
- To be safe, first stop the server and backup your configuration files
- Look in the /TOMCAT/conf installation folder.
- In the ‘server.xml’ file, you will find a line resembling…
<Connector port="8080" protocol="HTTP/1.1" connectionTimeout="20000" redirectPort="8443" />
- This one controls the HTTP/1.1 connections, add a new value to the list…
- NOTE You might also see a value for for AJP/1.3, unfortunately compression only works for HTTP:
<Connector port="8009" protocol="AJP/1.3" redirectPort="8443" />
- Restart your server.
Added in MSIE8 and Mozilla Firefox 3.6.9, Apple Safari 4, IE8, and Google Chrome 2 are several mechanisms to defend against cross-domain forgeries.
You can add to your website to make sure it is not embedded in a frame or iframe. This avoids clickjacking.
The X-Frame-Options HTTP response header can be used to indicate whether or not a browser should be allowed to render a page in a “
<frame>” or “
<iframe>“. Sites can use this to avoid clickjacking attacks, by ensuring that their content is not embedded into other sites.
NOTE: “ALLOW-FROM” is supported in some browsers
You can explicitly set this value for ApacheHTTP in the httpd.conf file, your .htaccess files or code it into the page(s) by the application itself.
Example, add this to the apache config file:
Header always set X-Frame-Options DENY
I was recently working on a website that had a black/dark background and while the typical suite of browsers that I test with seemed fine, Safari showed an annoying white flash when the page was loading.
The simplest fix, while not elegant, is to an explicit ‘style’ attribute on the <html> tag.