Content-Security-Policy and X-Frame-Options header config in http://antispam.csu.edu.au:32224/?dmVyPTEuMDAxJiY0YzA0ZThiMjA1NmJhYTkyNT01QzM3QjFEOV81NzM5OF84Nzk1XzEmJmZiNjI0N2U4ODdhYTNmZD0xMzMzJiZ1cmw9aWRwJTJFcHJvcGVydGllcw==

[Losen, Stephen C (scl)]

Hi folks,

Yes, Jetty is adding the headers and they are coincidentally the same as the IDP defaults.  Here is some output from “wget -S” (shows response headers).  The IDP is using the default config.  And now I see in the IDP30 wiki some instructions for configuring Jetty to do this (to mitigate clickjacking) which I evidently followed and forgot about.  Sorry for the noise.

HTTP request sent, awaiting response...
  HTTP/1.1 200 OK
  Content-Security-Policy: frame-ancestors 'none';
  X-Frame-Options: DENY
  Set-Cookie: JSESSIONID=13jb56j9hst4xs3tvwzavsdj6;Path=/idp;Secure;HttpOnly
  Expires:
  Cache-Control: no-store
  Content-Language: en-US
  Content-Type: text/html;charset=utf-8
  X-Frame-Options: DENY
  Strict-Transport-Security: max-age=0
  Content-Security-Policy: frame-ancestors 'none';
  Content-Length: 3171
  Server: Jetty(9.3.24.v20180605)


Stephen C. Losen
ITS - Systems and Storage
University of Virginia
scl at virginia.edu<mailto:scl at virginia.edu>    434-924-0640

From: users [mailto:users-bounces at shibboleth.net] On Behalf Of Brent Putman
Sent: Thursday, January 10, 2019 9:27 PM
To: Shib Users <users at shibboleth.net>
Subject: Re: Content-Security-Policy and X-Frame-Options header config in http://antispam.csu.edu.au:32224/?dmVyPTEuMDAxJiY0YzA0ZThiMjA1NmJhYTkyNT01QzM3QjFEOV81NzM5OF84Nzk1XzEmJmZiNjI0N2U4ODdhYTNmZD0xMzMzJiZ1cmw9aWRwJTJFcHJvcGVydGllcw==



On 1/10/19 5:33 PM, Cantor, Scott wrote:

On 1/10/19, 5:28 PM, "users on behalf of Losen, Stephen C (scl)" <users-bounces at shibboleth.net on behalf of scl at virginia.edu><mailto:users-bounces at shibboleth.netonbehalfofscl@virginia.edu> wrote:



In browser "developer" mode I definitely saw two X-Frame-Options headers and two Content-Security-Policy headers

coming from the IDP, so I guess "last header wins?"



I imagine which one wins is likely browser-dependent.







I can't reproduce that, so I don't know what to tell you. If it's Tomcat, then I'd rule that out. It does not physically do that in the code, it's a map with one entry per header name and if you're not supplying your own map object there's no way you could get the code to send two just by setting properties.



I also could not reproduce.  But obviously something somewhere somehow is setting them.

It would be interesting for the OP to unset the props in idp.properties entirely as discussed in the thread and then see whether both sets disappear, or only "ours". And/or if you comment out again in idp.properties to set the properties back to the defaults, do you now get 2 sets that are identical, or just 1 set?

In the servlet API adding headers is additive, so  just thinking that perhaps either the servlet container or a front-end web server is setting them (either automatically or by config), or possibly it's something that has been customized/added to web.xml that's not "ours".

It would also be helpful to know what the servlet container and version is.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20190111/f5c0ee9b/attachment.html>