[java-identity-provider] branch master updated: IDP-627 - Support HSTS, CSP, X-Frame-Options, etc.

[Scott Cantor]

This is an automated email from the git hooks/post-receive script.

scantor pushed a commit to branch master
in repository java-identity-provider.

View the commit online:
http://git.shibboleth.net/view/?p=java-identity-provider.git;a=commit;h=145a4a0df52b3422bf3551fa00717623f67c4b9c

The following commit(s) were added to refs/heads/master by this push:
       new  145a4a0   IDP-627 - Support HSTS, CSP, X-Frame-Options, etc.
145a4a0 is described below

commit 145a4a0df52b3422bf3551fa00717623f67c4b9c
Author: Scott Cantor <cantor.2 at osu.edu>
AuthorDate: Thu Aug 23 19:33:42 2018 -0400

    IDP-627 - Support HSTS, CSP, X-Frame-Options, etc.
    
    https://issues.shibboleth.net/jira/browse/IDP-627
    
    Defaults for X-Frame-Options, CSP.
---
 idp-conf/src/main/resources/conf/idp.properties           | 4 +++-
 idp-conf/src/main/resources/system/conf/global-system.xml | 3 ++-
 2 files changed, 5 insertions(+), 2 deletions(-)

diff --git a/idp-conf/src/main/resources/conf/idp.properties b/idp-conf/src/main/resources/conf/idp.properties
index 745107d..f14d3e7 100644
--- a/idp-conf/src/main/resources/conf/idp.properties
+++ b/idp-conf/src/main/resources/conf/idp.properties
@@ -22,7 +22,9 @@ idp.scope = example.org
 # HSTS response header policy
 #idp.hsts.maxAge = 0
 # X-Frame-Options value, set to DENY or SAMEORIGIN to block framing
-#idp.frameoptions = 
+#idp.frameoptions = DENY
+# Content-Security-Policy value, set to match X-Frame-Options default
+#idp.csp = frame-ancestors 'none';
 
 # Set the location of user-supplied web flow definitions
 #idp.webflows = %{idp.home}/flows
diff --git a/idp-conf/src/main/resources/system/conf/global-system.xml b/idp-conf/src/main/resources/system/conf/global-system.xml
index bf32695..fad1842 100644
--- a/idp-conf/src/main/resources/system/conf/global-system.xml
+++ b/idp-conf/src/main/resources/system/conf/global-system.xml
@@ -161,7 +161,8 @@
         <property name="sourceMap">
             <map>
                 <entry key="Strict-Transport-Security" value="max-age=%{idp.hsts.maxAge:0}" />
-                <entry key="X-Frame-Options" value="%{idp.frameoptions:}" />
+                <entry key="X-Frame-Options" value="%{idp.frameoptions:DENY}" />
+                <entry key="Content-Security-Policy" value="%{idp.csp:frame-ancestors 'none';}"/>
             </map>
         </property>
     </bean>

-- 
To stop receiving notification emails like this one, please contact
the administrator of this repository.