Setting Custom Headers XSS issues (6.1SP2)
I have a need to set custom response headers to address XSS vulnerabilities discivered in recent app scan.
I understand that in 7.XX we can take use of DSS to set custom response header. However, in 6.1 sp2 there is nothing that enables us to do so.
I have tried modifying the status.jsp to set the header but that does not work either
e.g status.jsp-->response.addHeader("X-XSS Protection Header", "1");
I am going to see if we can make changed to LB monitor but I am not sure that would work.
on an Native platform, e.g, if .Net app then you can set it through IIS manager but WAS does not provide anything.
I am going to open an SR tomorrow but wondering if peers have come across the same and have found a solution.
Below is what we need.
Content-Security-Policy
X-Content Type-Options
X-XSS Protection Header
x-Frame-Options
X-XSS Protection Policy
Pegasystems
IN
customHeaders is not available in 6.1SP2. Did you try using a Servlet filter? Google search for "adding http-header to request in servlet filter" will give you links to sample code.
Humana Inc.
US
Yes, I have done this by adding custom filters to the Web.xml.
Had to repackage the pradapter.jar after adding a custom class for below filter.
Custom Class: com.pega.pegarules.internal.web.servlet.WebStandardBootFilter
<filter>
<filter-name>RequestLoggingFilter</filter-name>
<filter-class>com.pega.pegarules.internal.web.servlet.WebStandardBootFilter</filter-class>
</filter>
<filter-mapping>
<filter-name>RequestLoggingFilter</filter-name>
<url-pattern>/PRServlet/*</url-pattern>
</filter-mapping>
Let me know if anyone needs help on this!!
Express script
US
Hi PEGATECH,
We too have similar kind of task in 6.2 could you please share the details of your implementation on enabling the customheader.
Below are the tag we want to set.
- X-Frame-Options
- X-XSS-Protection
- HTTP Strict-Transport-Security
- Content-Security-Policy