title: Tomcat HttpHeaderSecurityFilter filter entry ignored in conf/web.xml
body: <p>I am trying to enable the HttpHeaderSecurityFilter filter in Tomcat in order to combat click-jacking attacks. I want this applied to all applications, so have un-commented the default &lt;filter&gt; and &lt;filter-mapping&gt; entries for this filter in Tomcat's own conf/web.xml file. </p>
  
  <p>This seems to be completely ignored by Tomcat though from what I can tell. I added a META-INF/context.xml file to one of my web apps as follows, in order to see the effective web.xml file Tomcat uses for the app after merging the conf/web.xml file with the app's own file. </p>
  
  <pre><code>&lt;?xml version="1.0" encoding="utf-8" standalone="no"?&gt;
  &lt;Context logEffectiveWebXml="true"&gt;&lt;/Context&gt;
  </code></pre>
  
  <p>The resulting output in catalina.log looks valid (content of both files merged) with the exception that the filter entries from conf/web.xml are missing. I have tried introducing my own additional filter entries there and found those also do not appear in the effective web.xml.</p>
  
  <p>If I copy the HttpHeaderSecurityFilter filter and filter-mapping entries to the web app's own web.xml file, it works fine (but this is obviously not what I want!)</p>
  
  <p>Is there some trick to making Tomcat honour the filter entries in conf/web.xml?</p>
  
  <p>I ultimately need this to work in both Tomcat 7 and 8.  (I am aware the built-in filter was only added in Tomcat 7.0.63.)</p>