Some pages do not display properly when HTTP Strict Transport Security (HSTS) is configured.

Issue

When HTTP Strict Transport Security (HSTS) is configured in tomcat, some Liferay screens (site selection screen, fragment edit screen, etc.) do not display properly.

Environment

DXP 7.0+

solution

Liferay uses iframes on some pages.
Depending on the parameter settings, the header "X-Frame-Options" may be "DENY".
To correct this problem, the filter must be modified by adding the "antiClickJackingEnabled" and "antiClickJackingOption" parameters.

Parameter Sample：

<filter>
        <filter-name>httpHeaderSecurity</filter-name>
        <filter-class>org.apache.catalina.filters.HttpHeaderSecurityFilter</filter-class>
        <async-supported>true</async-supported>
        <init-param>
            <param-name>hstsEnabled</param-name>
            <param-value>true</param-value>
        </init-param> 
        <init-param>
            <param-name>hstsMaxAgeSeconds</param-name>
            <param-value>31536000</param-value>
        </init-param>
        <init-param>
            <param-name>hstsIncludeSubDomains</param-name>
            <param-value>true</param-value>
        </init-param>
            <init-param>
          <param-name>antiClickJackingEnabled</param-name>
          <param-value>true</param-value>
        </init-param>
        <init-param>
          <param-name>antiClickJackingOption</param-name>
          <param-value>SAMEORIGIN</param-value>
        </init-param>
    </filter>

Additional Information

Why LiferayDXP HTTP requests and responses do not contain certain security headers