Jetty configuration wiki page and configuration to help mitigate clickjacking

[Scott Koranda]

Hi,

Would the development team consider edits to this wiki page

https://wiki.shibboleth.net/confluence/display/IDP30/Jetty93

so that Jetty would add the headers

Content-Security-Policy: frame-ancestors 'none';
X-Frame-Options: DENY

to all responses?

I have the necessary changes to start.ini and a complimentary
JETTY_BASE/etc/jetty-rewrite.xml and have tested them with Jetty 9.3. I
suspect the same configuration would work for Jetty 9.2 but I do not
immediately have access to a 9.2 based deployment to test.

If the team is amenable I am happy to make the edits directly, or I could
send proposed edits along if the team would prefer to make edits directly.

Thanks for your consideration.

Scott K
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/dev/attachments/20180509/3eee9180/attachment.html>