[JAVA] IE 다운로드 안될경우 (엑셀 등등)

 

다른문제가 발생 할 수 있지만 response 필터 설정에 문제있을 확률이 높습니다.

X-Frame-Options가 'DENY'로 설정 되있을 경우 'SAMEORIGIN'으로 변경해주어야 합니다.

 

response.setHeader("X-Frame-Options", "DENY");  //옵션 차단

response.setHeader("X-Frame-Options", "SAMEORIGIN");  //옵션 해제

---

 

response설정부 X-Frame-Options 확인 (java 또는 xml)

---

@WebFilter("/*")
public class HttpHeaderSecurityFilter extends OncePerRequestFilter {

	/**
	 * <pre>
	 * Created by cogitos(YongHak Kim) on 2017. 10. 19.
	 * </pre>
	 *
	 * @param request
	 * @param response
	 * @param filterChain
	 * @throws ServletException
	 * @throws IOException
	 */
	@Override
	protected void doFilterInternal(HttpServletRequest request, HttpServletResponse response, FilterChain filterChain) throws ServletException, IOException {
		response.addHeader("Access-Control-Allow-Origin", "*");
		if (request.getHeader("Access-Control-Request-Method") != null && "OPTIONS".equals(request.getMethod())) {
			// CORS "pre-flight" request
			response.addHeader("Access-Control-Allow-Methods", "HEAD, GET, POST, PUT, DELETE");
			response.addHeader("Access-Control-Allow-Headers", "Authorization");
			response.addHeader("Access-Control-Max-Age", "1728000");
		}

		response.setHeader("X-XSS-Protection", "1; mode=block");
		response.setHeader("Strict-Transport-Security", "max-age=31536000; includeSubDomains");
		response.setHeader("X-Content-Type-Options", "nosniff");
		response.setHeader("Cache-control", "no-store, no-cache");
		response.setHeader("Cache-control", "Pragma, no-cache");
		response.setHeader("X-Frame-Options", "SAMEORIGIN"); //X-Frame-Options 설정이 DENY로 되어있지 않은지 확인
		response.setHeader("Set-Cookie", "XSRF-TOKEN=NDKDdfdsfkldsfNd3SZAJfwLsTl5WUgOkE; Path=/; Secure;HttpOnly");
		filterChain.doFilter(request, response);
	}
}