private void doFilterInternal(ServletRequest servletRequest, ServletResponse servletResponse) {
    if (servletResponse instanceof HttpServletResponse) {
      HttpServletResponse httpServletResponse = (HttpServletResponse) servletResponse;
      // Conditionally set the Strict-Transport-Security HTTP response header if SSL is enabled and
      // a value is supplied
      if (sslEnabled && !StringUtils.isEmpty(strictTransportSecurity)) {
        httpServletResponse.setHeader(STRICT_TRANSPORT_HEADER, strictTransportSecurity);
      }

      if (!StringUtils.isEmpty(xFrameOptionsHeader)) {
        // perform filter specific logic related to the X-Frame-Options HTTP response header
        httpServletResponse.setHeader(X_FRAME_OPTIONS_HEADER, xFrameOptionsHeader);
      }

      // Conditionally set the X-XSS-Protection HTTP response header if a value is supplied
      if (!StringUtils.isEmpty(xXSSProtectionHeader)) {
        httpServletResponse.setHeader(X_XSS_PROTECTION_HEADER, xXSSProtectionHeader);
      }

      // Conditionally set the Content-Security-Policy HTTP response header if a value is supplied
      if (!StringUtils.isEmpty(contentSecurityPolicyHeader)) {
        httpServletResponse.setHeader(CONTENT_SECURITY_POLICY_HEADER, contentSecurityPolicyHeader);
      }

      // Conditionally set the X-Content-Type HTTP response header if a value is supplied
      if (!StringUtils.isEmpty(xContentTypeHeader)) {
        httpServletResponse.setHeader(X_CONTENT_TYPE_HEADER, xContentTypeHeader);
      }

      // Conditionally set the X-Cache-Control HTTP response header if a value is supplied
      if (!StringUtils.isEmpty(cacheControlHeader)) {
        httpServletResponse.setHeader(CACHE_CONTROL_HEADER, cacheControlHeader);
      }

      // Conditionally set the X-Pragma HTTP response header if a value is supplied
      if (!StringUtils.isEmpty(pragmaHeader)) {
        httpServletResponse.setHeader(PRAGMA_HEADER, pragmaHeader);
      }

      // Conditionally set the Charset HTTP response header if a value is supplied
      if (!StringUtils.isEmpty(charset)) {
        httpServletResponse.setCharacterEncoding(charset);
      }
    }
  }
Checks whether the security headers need to be set, if so signals it in a request parameter.

@param servletRequest the incoming request
@return true if headers need to be set, false otherwise
ambari-server/src/main/java/org/apache/ambari/server/security/AbstractSecurityHeaderFilter.java