<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
</head>
<body text="#000000" bgcolor="#FFFFFF">
<p><br>
</p>
<div class="moz-cite-prefix">On 1/10/19 5:33 PM, Cantor, Scott
wrote:<br>
</div>
<blockquote type="cite"
cite="mid:FD5EED93-E706-4D06-9345-76BD3D00C5A8@osu.edu">
<pre class="moz-quote-pre" wrap="">On 1/10/19, 5:28 PM, "users on behalf of Losen, Stephen C (scl)" <a class="moz-txt-link-rfc2396E" href="mailto:users-bounces@shibboleth.netonbehalfofscl@virginia.edu"><users-bounces@shibboleth.net on behalf of scl@virginia.edu></a> wrote:
</pre>
<blockquote type="cite">
<pre class="moz-quote-pre" wrap="">In browser "developer" mode I definitely saw two X-Frame-Options headers and two Content-Security-Policy headers
coming from the IDP, so I guess "last header wins?"</pre>
</blockquote>
</blockquote>
<p><br>
</p>
<p>I imagine which one wins is likely browser-dependent.<br>
</p>
<p><br>
</p>
<blockquote type="cite"
cite="mid:FD5EED93-E706-4D06-9345-76BD3D00C5A8@osu.edu">
<blockquote type="cite">
<pre class="moz-quote-pre" wrap="">
</pre>
</blockquote>
<pre class="moz-quote-pre" wrap="">
I can't reproduce that, so I don't know what to tell you. If it's Tomcat, then I'd rule that out. It does not physically do that in the code, it's a map with one entry per header name and if you're not supplying your own map object there's no way you could get the code to send two just by setting properties.
</pre>
</blockquote>
<p><br>
</p>
<p>I also could not reproduce. But obviously something somewhere
somehow is setting them.</p>
<p>It would be interesting for the OP to unset the props in
idp.properties entirely as discussed in the thread and then see
whether both sets disappear, or only "ours". And/or if you comment
out again in idp.properties to set the properties back to the
defaults, do you now get 2 sets that are identical, or just 1 set?</p>
<p>In the servlet API adding headers is additive, so just thinking
that perhaps either the servlet container or a front-end web
server is setting them (either automatically or by config), or
possibly it's something that has been customized/added to web.xml
that's not "ours".</p>
<p>It would also be helpful to know what the servlet container and
version is.<br>
</p>
<blockquote type="cite"
cite="mid:FD5EED93-E706-4D06-9345-76BD3D00C5A8@osu.edu">
</blockquote>
</body>
</html>