Jira Server tomcat setting http headers security (version 7.2.7)

[Piper W]

Hi,

IT told that we should use web as belows to check our header security,

https://www.atatus.com/tools/security-header

After checking, we got level D, IT said we should upgrade to level A

Our Jira server is windows server,and uses tomcat, not IIS.

I have tried editing web.xml by inserting below contents, but it doesn't work, even the site can't display normally.

<filter>
<filter-name>httpHeaderSecurity</filter-name>
<filter-class>org.apache.catalina.filters.HttpHeaderSecurityFilter</filter-class>
<async-supported>true</async-supported>
<init-param>
<param-name>Strict-Transport-Security</param-name>
<param-value>max-age=31536000; includeSubDomains</param-value>
</init-param>
<init-param>
<param-name>Content-Security-Policy</param-name>
<param-value>default-src 'self'; script-src 'self' 'unsafe-inline'; style-src 'self' 'unsafe-inline'</param-value>
</init-param>
<init-param>
<param-name>X-Frame-Options</param-name>
<param-value>DENY</param-value>
</init-param>
<init-param>
<param-name>Referrer-Policy</param-name>
<param-value>no-referrer</param-value>
</init-param>
<init-param>
<param-name>Permissions-Policy</param-name>
<param-value>geolocation=(), microphone=(), camera=()</param-value>
</init-param>
</filter>

<filter-mapping>
<filter-name>httpHeaderSecurity</filter-name>
<url-pattern>/*</url-pattern>
</filter-mapping>

I have some questions:

1. Can Jira server 7.2.27 tomcat edit headers security?

2. If so, how do I do?

Thanks for any reply!

[Clark Everson]

Hi Piper,

possibly but from what I can see it’s just slightly off

```<filter>
<filter-name>addDefaultCharsetFilter</filter-name>
<filter-class>org.apache.catalina.filters.AddDefaultCharsetFilter</filter-class>
<init-param>
<param-name>defaultCharset</param-name>
<param-value>UTF-8</param-value>
</init-param>
</filter>
<filter>
<filter-name>customHeaderFilter</filter-name>
<filter-class>org.apache.catalina.filters.HeaderFilter</filter-class>
<init-param>
<param-name>headerConfig</param-name>
<param-value>
Strict-Transport-Security= max-age=31536000; includeSubDomains,
Content-Security-Policy= default-src 'self'; script-src 'self' 'unsafe-inline'; style-src 'self' 'unsafe-inline',
X-Frame-Options= DENY,
Referrer-Policy= no-referrer,
Permissions-Policy= geolocation=(), microphone=(), camera=()
</param-value>
</init-param>
</filter>
<filter-mapping>
<filter-name>addDefaultCharsetFilter</filter-name>
<url-pattern>/*</url-pattern>
</filter-mapping>
<filter-mapping>
<filter-name>customHeaderFilter</filter-name>
<url-pattern>/*</url-pattern>
</filter-mapping>```

hope this helps

clark

[Piper W]

Hi Clark,

Thanks for relplying.

Before testing this, I have another question:

Does this solution work on jira server version 7.2.7 ?

I'm not sure if version 7.2.7 supports this method. since I edited web.xml using my origin code but the site can't open succuessfully.

[Clark Everson]

Honestly I don’t know but 7.2.7 is we’ll beyond supported you should definitely upgrade because you’re way outside of both support and security even beyond server support going away

you should also always have a lower environment to test on

[Piper W]

Hi Clark,

Thanks and another question.

I've tried adding filter in web.xml, and http header security upgraded to C.

IT gave us a jar file as belows and told to add in C://Program Files/Atlassian/JIRA/lib

But it didn't work for JIRA.

Do you know how to modify it to fit Jira Server?

jar file

----------------------------------------------------------------------------

import java.io.IOException;

import javax.servlet.Filter;

import javax.servlet.FilterChain;

import javax.servlet.FilterConfig;

import javax.servlet.ServletException;

import javax.servlet.ServletRequest;

import javax.servlet.ServletResponse;

import javax.servlet.http.HttpServletResponse;

public class MyFilter implements Filter {

     @Override

     public void init(FilterConfig arg0) { }

     @Override

     public void destroy() { }

     public void doFilter(ServletRequest request, ServletResponse response,

                          FilterChain chain) throws IOException, ServletException {

         HttpServletResponse httpServletResponse = ((HttpServletResponse) response);

         httpServletResponse.addHeader("Content-Security-Policy",          "script-src 'self' 'unsafe-inline' https://OURWEBSITE.com 'unsafe-eval'");

         httpServletResponse.addHeader("Referrer-Policy",                       "strict-origin-when-cross-origin");

         httpServletResponse.addHeader("Permissions-Policy",                "geolocation=(),midi=()");

         httpServletResponse.addHeader("X-Permitted-Cross-Domain-Policies",    "none");

         httpServletResponse.addHeader("Feature-Policy",                    "camera 'none'; fullscreen 'self'");

         httpServletResponse.addHeader("Expect-CT",                             "enforce, max-age=31536000");

         chain.doFilter(request, response);

     }

}

web.xml

----------------------------------------------------------------------------

<filter>

<filter-name>myFilter</filter-name>

        <filter-class>ext.filter.MyFilter</filter-class>

</filter>

<filter-mapping>

        <filter-name>myFilter</filter-name>

        <url-pattern>/*</url-pattern>

</filter-mapping>