nav[aria-label="Primary Navigation"] { padding: 0; & ul { list-style: none; width: 100%; display: flex; flex-direction: row; justify-content: start; align-items: start; gap: 30px; padding: 0; & li { margin: 0; } & ul li { list-style: none; } } }

X-Frame-Options and CSP HTTP Headers

Alessandro Casella_jey5u4

If our public status page is tested against clickjacking it results vulnerable to this kind of attack, due to the lack of X-Frame-Options and CSP HTTP headers. Is there a way to set X-Frame-Options and CSP in HTTP response headers?

Accepted answers

Abraham Musalem

Hi @Alessandro Casella ,

Thanks for reaching out about this. We do have a feature request for this open right now: STATUS-96.

My engineering team is gathering interest on it and might decide to implement it soon. Feel free to reach out via support.atlassian.com if you want more information.

Best,
- Abraham

All comments

Abraham Musalem

Dave Ireland

Please add this feature. Our site scores a "D" on securityheaders.com and drags down our bitsight rating.

Thanks

Dave

Mo_mp7s11

Please add those missing HTTP headers, such as X-Frame and CSP , they are strong OWASP requirements and a good practice in ISO/IEC27001, NIST,..

William Nuss

Please add those missing HTTP headers. This is becoming a significant issue with 3rd party risk assessment, impacting the cost of cyber insurance, and the willingness of customers to engage. It seems trivial, but the tools in the space to assess 3rd party risk are generally based on sampling of available resources and then an overall assessment made based on this sampling. While this may not seem fair, it is becoming the overall approach in this space.

By using statuspage we in essence our reducing our cyber security rating and potentially increasing our cyber insurance costs.

Needed headers:

Cache-Control
Content-Security-Policy
Expires
HTTP Strict-Transport-Security
X-Content-Type-Options