How to disable new X-FRAM-OPTIONS security header

Question

Dear Support

After upgrade to Jira Software 7.6.1 i found out, that i can't embedd Jira sites on our Confluence page anymore via iframe. I found out that this is a new security feature (JRASERVER-25143). In this articel it's described, that one can disable this protection by setting the com.atlassian.jira.clickjacking.protection.disabled system property to true.

There's also a site which should describe how to do the Setting properties and options. But this site describes how you set Java Options for the service. When i inserted the property "com.atlassian.jira.clickjacking.protection.disabled=true" in the Java Options the service won't start anymore. So it has to be done somehow differently. Hope you can help!

Kind regards

Ueli

aurelain · Answer

Thank you very much, Ueli.

Indeed, the correct solution was to edit setenv.sh as follows:

JVM_SUPPORT_RECOMMENDED_ARGS="-Dcom.atlassian.jira.clickjacking.protection.disabled=true"

The Attlassian Team should also update the Setting properties and options page accordingly.

Volker Endriss · Answer

Hi Aurelian

To make work what you want you have to set the propertiy

"-Dcom.atlassian.jira.clickjacking.protection.disabled=true" to your JIRA Installation. This worked for me.

Cheers, Uli

aurelain · Answer

Hi, Branden.

My use-case is a little different: I actually need to embed my own JIRA in a normal webpage :) .

(No Confluence envolved)

Cheers,
Aurelian