ClickJacking filter to add X-FRAME-OPTIONS in response

Question

To allow clickJacking and block my site from opening iframes, I created a servlet filter to which I add the line below to add the response header X-FRAME-OPTIONS. But when I start the page and see the response headers of this page, I never get this header. Any idea why?

public void doFilter( ServletRequest request, ServletResponse response, FilterChain chain ) throws IOException, ServletException { HttpServletResponse res = (HttpServletResponse)response; chain.doFilter(request, response); //Specify the mode res.addHeader("X-FRAME-OPTIONS", "DENY"); } 

Answer 1

You need to add a header before calling doFilter . After the return time from doFilter headers and body are already sent, so your addHeader ignored.