Which web.xml is used by Confluence?

Colin Craigie_2cm5tc

Confluence 7.19.6 on Windows Server 2019 Standard and Tomcat 9.0.65

Hi. Hope someone can advise with this please? Our penetration test threw up a few things that need to be addressed. One thing is MULTIPLE MISSING HTTP SECURITY HEADERS

I have found that these can be added to, or already exist in the web.xml. Now I am confused about which web.xml is being used by Confluence. There is the web.xml in Atlassian\Conf and another one in Atlassian\Confluence\confluence\WEB-INF

I was of the opinion that it is using the web.xml in WEB-INF but that does not contain anything related to httpHeaderSecurity whereas the one in conf does. In the conf web.xml they are all commented out. The WEB-INF web.xml contains references to Confluence whereas the conf/web.xml appears to be entirely generic

Perhaps both are in play in some form or another? Which file should I be adding my HTTP Headers to in order to tighten up my web application security please?

Since I have Confluence connected to JIRA and am using JIRA Directory Server I also need to be careful that I don't unwittingly break my access between the two applications

Any assistance or advice gratefully received. TIA 

 

Nic Brough -Adaptavist-

Welcome to the Atlassian Community!

You don't tell us exactly where the two web.xml files are, so I can't really answer the question completely.  Not in a "missing data" sense - you have given us a couple of partial paths which is very clear, but I can't tell what they are from what you have said.

The question is what is in the directories you've given us - not the content, but what it's for.  Where is your Confluence installed in relation to those directories?

As an example, I've got a development system on this machine that has

./confluence/webapp/WEB-INF/web.xml
./container/tomcat9x/apache-tomcat-9.0.11/conf/web.xml

There's a pile of extra ones because it is a development system, but I've removed them from the list to keep it simple.  However, it isn't in quite the same structure as a standard non-development install.

The important bit here is that the web.xml in the Confluence/webapp is a config file for the application, and the web.xml in the Tomcat directory is the config file for Tomcat.

The Confluence application does not do headers itself; it simply runs on Tomcat and assumes that it has been configured to serve up the pages Confluence generates.

I think you need to be looking at the Tomcat web.xml.  Unless you want to try to do something clever with different pages or areas in Confluence, it's going to be best just to have Tomcat apply the same headers for everything Confluence serves.  Confluence is an application; Tomcat is a web-application-server, it's going to be easier and better to do security stuff in the application server (but if you're behind a proxy, I'd recommend that being the first place to look - most people I work with make Internet -> Apache/Nginx -> Tomcat on a local and totally firewalled server -> Atlassian application, and do most of the security at the Apache/Nginx level)

Whatever you want to tighten up, it is unlikely to break your Confluence/Jira connection - that's a simple call over http or https to the Jira server that doesn't look at headers like browsers do.