Configuring HTTP Header Options

Application servers usually provide mechanisms to secure HTTP headers. For example:

• X-Content-Type-Options
• X-XSS-Protection

For Tomcat, both options are described in Apache's Tomcat documentation.