Qualys flags as 11827. Apache: Header always append X-Frame-Options SAMEORIGIN nginx: add_header X-Frame-Options SAMEORIGIN; HAProxy: rspadd X-Frame-Options:\ SAMEORIGIN IIS: X-XSS-Protection: Apache: Header always set X-XSS-Protection "1; mode=block" PHP: header("X-XSS-Protection: 1; mode=block"); X-Content-Type-Options: Apache: Header always set X-Content-Type-Options: nosniff

Odd, it seems to change for any given page - yet still not all are showing. Loaded a different page and part of the sources showed this in response headers, but only one of the 3 required headers: * Cache-Control: no-cache * Content-Type: application/json * Date: Fri, 06 Apr 2018 21:29:30 GMT * Server: Apache-Coyote/1.1 * Transfer-Encoding: chunked * X-ASEN: SEN-1000 * X-AUSERNAME: user * X-Confluence-Cluster-Node: 12345 * X-Content-Type-Options: nosniff * X-Seraph-LoginReason: OK

nav[aria-label="Primary Navigation"] { padding: 0; & ul { list-style: none; width: 100%; display: flex; flex-direction: row; justify-content: start; align-items: start; gap: 30px; padding: 0; & li { margin: 0; } & ul li { list-style: none; } } }

Do the latest WIKI/JIRA versions utilize the HTTP Security Headers

Lloyd Chandler

Qualys flags as 11827.

Apache: Header always append X-Frame-Options SAMEORIGIN
nginx: add_header X-Frame-Options SAMEORIGIN;
HAProxy: rspadd X-Frame-Options:\ SAMEORIGIN
IIS: <HTTPPROTOCOL><CUSTOMHEADERS><ADD NAME="X-Frame-Options" VALUE="SAMEORIGIN"></ADD></CUSTOMHEADERS></HTTPPROTOCOL>
X-XSS-Protection:
Apache: Header always set X-XSS-Protection "1; mode=block"
PHP: header("X-XSS-Protection: 1; mode=block");
X-Content-Type-Options:
Apache: Header always set X-Content-Type-Options: nosniff

Accepted answers

All comments

Shaun S

Hi Lloyd,

The headers you provided are all used by default in the latest versions JIRA and Confluence. Did the Qualys report provide you the security header that was detected missing from the request?

Lloyd Chandler

It stated they are all missing - but we are not using the latest versions of either JIRA or Confluence - so what versions did Atlassian change to start using these? We are at 6.5.0 on confluence and 7.5.2 on JIRA

Shaun S

The X-FRAME-OPTIONS and Content Security Policy headers were introduced in JIRA 7.6.0 (see JRASERVER-25143). These were also introduced in Confluence 5.8.15 (see CONFSERVER-22952). If you're serving your applications behind a reverse proxy you can configure the headers on that level without needing to upgrade JIRA. The JIRA feature request I linked to includes instructions for Apache. If users are accessing JIRA directly, upgrading to 7.6.0 should do the trick.

Lloyd Chandler

Odd- we are being flagged on port 8443, which is our Confluence port - and we are on 6.5.0 and the security headers are not present. Not understanding what is wrong here. We are not using any reverse proxy.

Shaun S

If you inspect the requests using something like Chrome's built in dev tool, you should be able to determine if the security headers are present. Any one of the requests in the list will contain them if they are present. I've attached a screenshot for reference.

If you're seeing those headers present, I suspect something is triggering a false positive.

Lloyd Chandler

Just loaded one of the pages and went into Dev tools - My response headers do NOT show any of the security headers - so something is wrong:

This is all I see:

Content-Type: application/json
Date: Fri, 06 Apr 2018 21:27:36 GMT
Server: Apache-Coyote/1.1
X-ASEN: SEN-1000

Welcome!

It looks like you're new here. Sign in or register to get started.

Quick Links

Find more posts tagged with

confluence

jira