configuring Content-Security-Policy in tomcat
<p>I read about configuring/implementing Content-Security-Policy header and I came accross 2 ways of doing it:</p>

<ol>
<li>using custom filter that implements Filter as given in <a href="https://stackoverflow.com/questions/37306300/can-tomcat-7-be-configured-to-insert-content-security-policy-http-header">this</a> link</li>
<li>using meta tag </li>
</ol>

<p>Please note that this question is not duplicate of <a href="https://stackoverflow.com/questions/37306300/can-tomcat-7-be-configured-to-insert-content-security-policy-http-header">this</a>, Iam looking for a solution better than given in <a href="https://stackoverflow.com/questions/37306300/can-tomcat-7-be-configured-to-insert-content-security-policy-http-header">this</a> link</p>

<p>I see the drawbacks in (1) is its driven through code, not through a configuration file , drawbacks in option (2) is if I have say 100 html files, I need to put this tag in every HTML? (correct me if I'm wrong)
The solution I'm looking for is something I can configure in web.xml and becomes applicable for all the html files. Something the way we do in case of configuring X-Frame-Options in web.xml like given <a href="https://stackoverflow.com/questions/34991226/xframe-option-in-tomcat-7">here</a>, don't we have similar way of configuring Content-Security-Policy in web.xml ?</p>