12.1.5 Removing HTTP Strict Transport Security

Open the Administration Console web.xml file and comment out the httpHeaderSecurity filter definition.

<filter>
<filter-name>httpHeaderSecurity</filter-name>
<filter-class>org.apache.catalina.filters.HttpHeaderSecurityFilter</
filter-class>
<async-supported>true</async-supported>
</filter>

Comment out the following parameter that sets up an appropriate maximum age value:

<init-param>
<param-name>hstsMaxAgeSeconds</param-name>
<param-value>31536000</param-value>
</init-param>

Comment out the filter mapping.

<filter-mapping>
<filter-name>httpHeaderSecurity</filter-name>
<url-pattern>/*</url-pattern>
<dispatcher>REQUEST</dispatcher>
</filter-mapping>