How to disable new X-FRAM-OPTIONS security header

Dear Support

 

After upgrade to Jira Software 7.6.1 i found out, that i can't embedd Jira sites on our Confluence page anymore via iframe. I found out that this is a new security feature (JRASERVER-25143). In this articel it's described, that one can disable this protection by setting the com.atlassian.jira.clickjacking.protection.disabled system property to true

There's also a site which should describe how to do the Setting properties and options. But this site describes how you set Java Options for the service. When i inserted the property "com.atlassian.jira.clickjacking.protection.disabled=true" in the Java Options the service won't start anymore. So it has to be done somehow differently. Hope you can help!

 

Kind regards

 

Ueli

2 answers

I also tried the following options, but none worked:

  1. In setenv.sh:
    JVM_SUPPORT_RECOMMENDED_ARGS="-Datlassian.jira.clickjacking.protection.disabled=true  "

  2. In setenv.sh:
    JVM_SUPPORT_RECOMMENDED_ARGS="-Datlassian.clickjacking.protection.disabled=true"

  3. In web.xml:
    <filter>
          <filter-name>HTTP Header Security Filter</filter-name>
          <filter-class>org.apache.catalina.filters.HttpHeaderSecurityFilter</filter-class>
          <init-param>
            <param-name>antiClickJackingEnabled</param-name>
            <param-value>false</param-value>
          </init-param>
    </filter>

So, this is still unresolved...

Hi Aurelian,

Those look like the arguments for JIRA.  You need to configure this on the Confluence side.  See Confluence page does not display in an iframe for the correct arguments for Confluence. 

Additionally, take a look at the very last comment in the post titled How to remove or modify Confluence X-Frame-Options response header for another suggestion.

Cheers,

Branden

Hi, Branden.

My use-case is a little different: I actually need to embed my own JIRA in a normal webpage :).

(No Confluence envolved)

Cheers,
Aurelian

Hi Aurelian

 

To make work what you want you have to set the propertiy

"-Dcom.atlassian.jira.clickjacking.protection.disabled=true" to your JIRA Installation. This worked for me.

 

Cheers, Uli

Thank you very much, Ueli.

Indeed, the correct solution was to edit setenv.sh as follows:

JVM_SUPPORT_RECOMMENDED_ARGS="-Dcom.atlassian.jira.clickjacking.protection.disabled=true"

The Attlassian Team should also update the Setting properties and options page accordingly.

0 vote

Hi Ueli,

I get the same behavior in JIRA, however, according to Confluence page does not display in an iframe the changes are supposed to be done on the Confluence side:

Resolution 1

Disable clickjacking protection from Confluence

  1. Shut down Confluence

  2. If you're running Linux:
    1. In <confluence_install>/bin/setenv.sh add the line:
      CATALINA_OPTS="-Dconfluence.clickjacking.protection.disable=true ${CATALINA_OPTS}"
  3. If you're running Windows from the .bat file:
    1. In <confluence_install>/bin/setenv.bat add the line:

      set CATALINA_OPTS=-Dconfluence.clickjacking.protection.disable=true %CATALINA_OPTS%
  4. If you're running Windows as a service:
    1. If you're starting Confluence as a service, then you'll need to add the following startup options to the Java tab in the service properties:

      -Dconfluence.clickjacking.protection.disable=true
  5. Restart Confluence

(info) See Configuring System Properties for more on setting System Properties.

The Page will now appear in the iframe.

Resolution 2

If the resolution 1 does not work then there is a possibility that in CONFLUENCE_INSTALL/conf/web.xml you have enabled HTTP Header Security Filter in Tomcat. 

  1. Shut down Confluence
  2. Open CONFLUENCE_INSTALL/conf/web.xml and find antiClickJackingOption
  3. Uncomment the parameter and change the value from DENY to SAMEORIGIN
  4. Restart Confluence

Please see Apache Tomcat 8 Configuration ReferenceHTTP Header Security Filter for more information on the parameters

Try the steps above and let me know the results.

Cheers,

Branden

Suggest an answer

Log in or Sign up to answer
Atlassian Community Anniversary

Happy Anniversary, Atlassian Community!

This community is celebrating its one-year anniversary and Atlassian co-founder Mike Cannon-Brookes has all the feels.

Read more
Community showcase
Sarah Schuster
Posted Mar 28, 2018 in Jira Software

Can a company’s culture make or break agile adoption?

Can a new-to-agile team survive and thrive in a non-agile culture? If so, what advice would you give to those trying to be agile in a non-agile culture? What's the key(s) to success? Share your thoug...

11,811 views 13 13
Join discussion

Atlassian User Groups

Connect with like-minded Atlassian users at free events near you!

Find a group

Connect with like-minded Atlassian users at free events near you!

Find my local user group

Unfortunately there are no AUG chapters near you at the moment.

Start an AUG

You're one step closer to meeting fellow Atlassian users at your local meet up. Learn more about AUGs

Groups near you