Jira Server tomcat setting http headers security (version 7.2.7)

Question

Hi, IT told that we should use web as belows to check our header security, https://www.atatus.com/tools/security-header After checking, we got level D, IT said we should upgrade to level A Our Jira server is windows server,and uses tomcat, not IIS. I have tried editing web.xml by inserting below contents, but it doesn't work, even the site can't display normally.

httpHeaderSecurity

org.apache.catalina.filters.HttpHeaderSecurityFilter

true

Strict-Transport-Security

max-age=31536000; includeSubDomains

Content-Security-Policy

default-src 'self'; script-src 'self' 'unsafe-inline'; style-src 'self' 'unsafe-inline'

X-Frame-Options

DENY

Referrer-Policy

no-referrer

Permissions-Policy

geolocation=(), microphone=(), camera=()

httpHeaderSecurity

/*

I have some questions: 1. Can Jira server 7.2.27 tomcat edit headers security? 2. If so, how do I do? Thanks for any reply!

Piper W · Answer

Hi Clark, Thanks and another question. I've tried adding filter in web.xml, and http header security upgraded to C. IT gave us a jar file as belows and told to add in C://Program Files/Atlassian/JIRA/lib But it didn't work for JIRA. Do you know how to modify it to fit Jira Server? jar file ---------------------------------------------------------------------------- import java.io.IOException; import javax.servlet.Filter; import javax.servlet.FilterChain; import javax.servlet.FilterConfig; import javax.servlet.ServletException; import javax.servlet.ServletRequest; import javax.servlet.ServletResponse; import javax.servlet.http.HttpServletResponse; public class MyFilter implements Filter { @Override public void init(FilterConfig arg0) { } @Override public void destroy() { } public void doFilter(ServletRequest request, ServletResponse response, FilterChain chain) throws IOException, ServletException { HttpServletResponse httpServletResponse = ((HttpServletResponse) response); httpServletResponse.addHeader("Content-Security-Policy", "script-src 'self' 'unsafe-inline' https://OURWEBSITE.com 'unsafe-eval'"); httpServletResponse.addHeader("Referrer-Policy", "strict-origin-when-cross-origin"); httpServletResponse.addHeader("Permissions-Policy", "geolocation=(),midi=()"); httpServletResponse.addHeader("X-Permitted-Cross-Domain-Policies", "none"); httpServletResponse.addHeader("Feature-Policy", "camera 'none'; fullscreen 'self'"); httpServletResponse.addHeader("Expect-CT", "enforce, max-age=31536000"); chain.doFilter(request, response); } } web.xml ----------------------------------------------------------------------------

myFilter

ext.filter.MyFilter

myFilter

/*

Clark Everson_btzcub · Answer

Honestly I don’t know but 7.2.7 is we’ll beyond supported you should definitely upgrade because you’re way outside of both support and security even beyond server support going away

you should also always have a lower environment to test on

Piper W · Answer

Hi Clark,

Thanks for relplying.

Before testing this, I have another question:

Does this solution work on jira server version 7.2.7 ?

I'm not sure if version 7.2.7 supports this method. since I edited web.xml using my origin code but the site can't open succuessfully.