Lack of HTTP Security Headers

IdentityIQ (IIQ) IIQ Discussion and Questions
1

Which IIQ version are you inquiring about?

8.3p1

Please share any images or screenshots, if relevant.

image
image1372×421 109 KB

Several HTTP headers are used to define behaviors and limitations that affect the
clients that connect to the server, and each of them is focused on a different security
feature. The recommended headers to be implemented are:
• “Content-Security-Policy: default-src ‘self’”
• “X-Frame-Options: DENY”
• “X-Content-Type-Options: nosniff”
• “Strict-Transport-Security”
During the current assessment, the vulnerability team has identified that there are following
headers are not present inside the server’s responses:
• “Content-Security-Policy: default-src ‘self’”
• “X-Content-Type-Options: nosniff”
• “Strict-Transport-Security”

Could anyone have any idea to add this into our SailPoint header. so we can avoid this vulnerability.

Thanks,

2

Hi,

that should be possible as configuration on the webserver running IIQ. So most probably tomcat. It should be possible to add them via a filter in the web.xml

Regards Felix

3

Hi @Felix_Witt ,

we tried adding this but unfortunately it is not working, if you have exact command or exact code please paste here so i can do the same in my lower environment.

Thanks

4

Sorry but we haven’t made that change yet. How does your web.xml look on the application server?

5

This topic was automatically closed 60 days after the last reply. New replies are no longer allowed.