HTTP Security Headers
Document and support the definition of HTTP headers in the ivy.yaml.
Audience
Value
- 📄 Updated documentation
- 🛠️ Configure HTTP headers via ivy.yaml
WebServer.HttpHeaders
Referrer-Policy now set by default to strict-origin-when-cross-origin
- 🛠️ Configure PrimeFaces
Content-Security-Policy via ivy.yaml WebServer.PrimeFaces
- It is defined by default for the Engine-Cockpit and the Dev-Workflow-UI as they live in their own context
- 👀 Show response headers in the Engine-Cockpit Web Server page
- 🗑️ The
HttpHeaderSecurityFilter via the web.xml is no longer configured by default and deprecated.
- The
X-Frame-Options and the X-Content-Type-Options header are now defined via the ivy.yaml
- The
Strict-Transport-Security header can be defined via ivy.yaml but should be defined in your reverse proxy
- Migration Notes
Version
- 13.2
- 12.0.8 (only documentation and ivy.yaml support)
Discussion
Questions?
Next steps
Screenshots / Code
WebServer:
# HTTP Headers that are added to a server response.
# [restart required]
HttpHeaders:
# https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Headers/Cross-Origin-Embedder-Policy
# [restart required]
# [examples: unsafe-none, require-corp, credentialless]
Cross-Origin-Embedder-Policy: ""
# https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Headers/Cross-Origin-Opener-Policy
# [restart required]
# [examples: unsafe-none, same-origin-allow-popups, same-origin, noopener-allow-popups]
Cross-Origin-Opener-Policy: ""
# https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Headers/Cross-Origin-Resource-Policy
# [restart required]
# [examples: same-site, same-origin, cross-origin]
Cross-Origin-Resource-Policy: ""
# https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Headers/Referrer-Policy
# [restart required]
# [examples: no-referrer, no-referrer-when-downgrade, origin, origin-when-cross-origin, same-origin, strict-origin, strict-origin-when-cross-origin, unsafe-url]
Referrer-Policy: strict-origin-when-cross-origin
# https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Headers/Strict-Transport-Security
# [restart required]
# [examples: max-age=63072000]
Strict-Transport-Security: ""
# https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Headers/X-Content-Type-Options
# [restart required]
# [examples: nosniff]
X-Content-Type-Options: nosniff
# https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Headers/X-Frame-Options
# [restart required]
# [examples: DENY, SAMEORIGIN]
X-Frame-Options: SAMEORIGIN
PrimeFaces:
# https://primefaces.github.io/primefaces/13_0_0/#/core/contentsecuritypolicy?id=content-security-policy
# [restart required]
ContentSecurityPolicy:
# [examples: false, true, reportOnly]
Enabled: false
# [examples: object-src 'none'; base-uri 'none'; frame-ancestors 'self'; worker-src 'self' blob:; script-src 'strict-dynamic']
Policy: ""
ReportOnlyPolicy: ""
