Apache and Tomcat Integration - apache

Question

I'm fairly new with Apache and Tomcat, so try to explain me the better you know :P I'm only working in local.
I have one application that needs Tomcat to execute Servlets, so I can type:
http://localhost:8080/rrcapp/xservlet?consult=list01
That works. I also have my webpage running with Apache 2.4, so I can type:
http://localhost:80/websrv/index.htm
That works too. The problem comes when in my index.htm serving in Apache, make a call in an Iframe with Chrome, to that Servlet, getting the error:
Refused to display ...in a frame because it set 'X-Frame-Options' to 'SAMEORIGIN'.
I've read about setting in my httpd.conf to unset x-frame-options or setting with ALLOW-FROM but it seems just doesn't work with Chrome.
Then, I've read about CSP policies, but I cannot figure out how to set this kind of policy in mi httpd.conf so I can run servlets inside the iframe, inside my Apache server.
Can anyone help me with this?
Regards :)
EDIT 1:
Thanks Eddie James Carswell II I understood the error came from the Tomcat. I've read the document he showed me, and tried to configure my web.xml inside my /conf dir in Tomcat, this is the result:
<filter>
<filter-name>httpHeaderSecurity</filter-name>
<filter-class>org.apache.catalina.filters.HttpHeaderSecurityFilter</filter-class>
<async-supported>true</async-supported>
<init-param>
<param-name>antiClickJackingEnabled</param-name>
<param-value>true</param-value>
</init-param>
<init-param>
<param-name>antiClickJackingOption</param-name>
<param-value>ALLOW-FROM</param-value>
</init-param>
<init-param>
<param-name>antiClickJackingUri</param-name>
<param-value>http://localhost:80/*</param-value>
</init-param>
</filter>
<filter-mapping>
<filter-name>httpHeaderSecurity</filter-name>
<url-pattern>/*</url-pattern>
<dispatcher>REQUEST</dispatcher>
</filter-mapping>
I restarted the Tomcat server and tried again to load the Iframe and got another error:
Invalid 'X-Frame-Options' header encountered when loading 'http://localhost:8080/rrcapp/xservlet?consult=list01': 'ALLOW-FROM http://localhost:80/*' is not a recognized directive. The header will be ignored.
EDIT 2:
It seems it works on the most recent version of Firefox (57.0 Quantum) as well in IE 10 and EDGE. Still, it doesnt work with Chrome :P
Maybe ALLOW-FROM has some problems with Chrome, but if I'm not wrong, I cannot establish CSP directives in Tomcat. How can I resolve this on Chrome?
Any help here? :)
Thanks in advance

Answer 1

Firstly, I want to thanks to Eddie James Carswell II, who assisted me with this issue all the time, giving me very valuable tips.
Finally, I got it with Proxys via httpd. As stated in the article linked, uncommenting this lines:
LoadModule proxy_module modules/mod_proxy.so
LoadModule proxy_http_module modules/mod_proxy_http.so
And then configuring my app directory in Apache:
ProxyRequests Off
ProxyPass /rrcapp http://localhost:8080
ProxyPassReverse /rrcapp http://localhost:8080
<Location "/rrcapp">
Order allow,deny
Allow from all
</Location>
Now, I can write in a JS call,. Example:
document.location = '/rrcapp/xservlet?consult=list01';
And access to my apps resources, located in Tomcat.
Why this solution? Its universal in every browser, and easy to configure.
Why not the other one? It worked on the most recent version of Firefox (57.0 Quantum) as well in IE 10 and EDGE. Still, it didn't work with Chromem, wich is the browser I use. The configuration anyways set up, was this in the web.xml in Tomcat directory.
<filter>
<filter-name>httpHeaderSecurity</filter-name>
<filter-class>org.apache.catalina.filters.HttpHeaderSecurityFilter</filter-class>
<async-supported>true</async-supported>
<init-param>
<param-name>antiClickJackingEnabled</param-name>
<param-value>true</param-value>
</init-param>
<init-param>
<param-name>antiClickJackingOption</param-name>
<param-value>ALLOW-FROM</param-value>
</init-param>
<init-param>
<param-name>antiClickJackingUri</param-name>
<param-value>http://localhost:80/*</param-value>
</init-param>
</filter>
<filter-mapping>
<filter-name>httpHeaderSecurity</filter-name>
<url-pattern>/*</url-pattern>
<dispatcher>REQUEST</dispatcher>
</filter-mapping>
Hope this helps in the future :)
Thanks Eddie!