# Lack of HTTP Security Headers

**URL:** <https://developer.sailpoint.com/discuss/t/lack-of-http-security-headers/95956>\
**Category:** IIQ Discussion and Questions\
**Tags:** identityiq\
**Created:** [January 6, 2025, 6:53am UTC](https://developer.sailpoint.com/discuss/t/lack-of-http-security-headers/95956 "2025-01-06T06:53:52Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![kchengalvarayan](https://avatars.discourse-cdn.com/v4/letter/k/48db29/32.png) [@kchengalvarayan](https://developer.sailpoint.com/discuss/u/kchengalvarayan)\
**Post date:** [January 6, 2025, 6:53am UTC](https://developer.sailpoint.com/discuss/t/lack-of-http-security-headers/95956/1 "2025-01-06T06:53:52Z")

</div>

## Which IIQ version are you inquiring about?

8.3p1

## Please share any images or screenshots, if relevant.

 ![image](https://global.discourse-cdn.com/sailpoint/original/3X/d/c/dcc48a701a7e21307abe8a38361dede04e7a0cad.png)

Several HTTP headers are used to define behaviors and limitations that affect the  
clients that connect to the server, and each of them is focused on a different security  
feature. The recommended headers to be implemented are:  
• “Content-Security-Policy: default-src ‘self’”  
• “X-Frame-Options: DENY”  
• “X-Content-Type-Options: nosniff”  
• “Strict-Transport-Security”  
During the current assessment, the vulnerability team has identified that there are following  
headers are not present inside the server’s responses:  
• “Content-Security-Policy: default-src ‘self’”  
• “X-Content-Type-Options: nosniff”  
• “Strict-Transport-Security”

Could anyone have any idea to add this into our SailPoint header. so we can avoid this vulnerability.

Thanks,

---

<div class="post-metadata">

**Author:** ![Felix\_Witt](https://avatars.discourse-cdn.com/v4/letter/f/7ab992/32.png) [@Felix\_Witt](https://developer.sailpoint.com/discuss/u/Felix_Witt)\
**Post date:** [January 6, 2025, 8:50am UTC](https://developer.sailpoint.com/discuss/t/lack-of-http-security-headers/95956/2 "2025-01-06T08:50:36Z")

</div>

Hi,

that should be possible as configuration on the webserver running IIQ. So most probably tomcat. It should be possible to add them via a filter in the web.xml

Regards Felix

---

<div class="post-metadata">

**Author:** ![kchengalvarayan](https://avatars.discourse-cdn.com/v4/letter/k/48db29/32.png) [@kchengalvarayan](https://developer.sailpoint.com/discuss/u/kchengalvarayan)\
**Post date:** [January 7, 2025, 7:55am UTC](https://developer.sailpoint.com/discuss/t/lack-of-http-security-headers/95956/3 "2025-01-07T07:55:31Z")

</div>

Hi @Felix_Witt ,

we tried adding this but unfortunately it is not working, if you have exact command or exact code please paste here so i can do the same in my lower environment.

Thanks

---

<div class="post-metadata">

**Author:** ![Felix\_Witt](https://avatars.discourse-cdn.com/v4/letter/f/7ab992/32.png) [@Felix\_Witt](https://developer.sailpoint.com/discuss/u/Felix_Witt)\
**Post date:** [January 13, 2025, 1:25pm UTC](https://developer.sailpoint.com/discuss/t/lack-of-http-security-headers/95956/4 "2025-01-13T13:25:53Z")

</div>

Sorry but we haven’t made that change yet. How does your web.xml look on the application server?

---

<div class="post-metadata">

**Author:** ![system](https://global.discourse-cdn.com/sailpoint/original/2X/f/f2136700ed5e3703e0b85e02f6be799dacca7735.png) [@system](https://developer.sailpoint.com/discuss/u/system)\
**Post date:** [March 14, 2025, 1:26pm UTC](https://developer.sailpoint.com/discuss/t/lack-of-http-security-headers/95956/5 "2025-03-14T13:26:11Z")

</div>

Closed on March 14, 2025, 1:26pm UTC

This topic was automatically closed 60 days after the last reply. New replies are no longer allowed.