Question
Accenture
US
Last activity: 23 May 2017 14:27 EDT
Preventing Pega Applications from clickjacking attack
Hi,
I need help on preventing pega application from clickjacking attack. Please let me know if you have information. Thank you.
Regards,
Praveen.
Pegasystems Inc.
AU
Hi Praveen,
X-FRAME-OPTIONS header need to be configured to your application server to insert this into every html stream returned to the client.
Regards,
Basavaraj
Accepted Solution
Pegasystems Inc.
IN
Hi Praveen,
Can you please let us know what is the PRPC version you are using?
Starting from PRPC 7.2.1 you can find the DSS with setting purpose as Http/ResponseHeaders to add or modify the custom headers where you can add X-FRAME-OPTIONS header in PRPC application and provide the value based on your security needs.
You can refer the following link on how to add the custom headers:
Accenture
US
7.2.1 version.
Pegasystems Inc.
IN
Starting from Pega 7.2.2 Content security policy rule types can be used to avoid clickjacking ( through "frame-ancestors" directive). Details on CSP can be found here.
https://community.pega.com/sites/default/files/help_v722/procomhelpmain.htm
Thanks.