Jetty configuration wiki page and configuration to help mitigate clickjacking

[Scott Koranda]

> If it's useful I could just add that CSP header in and define a
> property for that, I just didn't have much to default it to at the
> time. If the frame thing is baked, that would be a likely candidate.
> 
>     <bean id="shibboleth.DefaultResponseHeaderMap"
>             class="org.springframework.beans.factory.config.MapFactoryBean">
>         <property name="sourceMap">
>             <map>
>                 <entry key="Strict-Transport-Security" value="max-age=%{idp.hsts.maxAge:0}" />
>                 <entry key="X-Frame-Options" value="%{idp.frameoptions:}" />
>             </map>
>         </property>
>     </bean>

I think it would be useful to include the CSP header and default it to 

frame-ancestors 'none';

and also to default X-Frame-Options to

DENY

Anybody wanting more sophisticated (or more permissive) CSP values could
then configure it as they see fit.

I realize there is a lot more that CSP could do, but this would allow
the project to "put a stake in the ground" and then ask the community
for help deciding on how best to evolve the CSP default(s).

Should I re-open that JIRA and add this suggestion?

Thanks,

Scott K