Protected Web Pages are missing security headers in SPS and Web Agent

Products

• CA Single Sign On Secure Proxy Server (SiteMinder)
• CA Single Sign On Agents (SiteMinder)
• CA Single Sign On Federation (SiteMinder)
• CA Single Sign On SOA Security Manager (SiteMinder)
• SITEMINDER

Issue/Introduction

It was observed that the application was not sending security directives to the client's browser like Content Security Policy (1), X-XSS Protection (2), HSTS (HTTP Strict Transport Security) (3), and X-Content-Type-Options (4).

 

Resolution

 

Mainly, the control of these headers is maintained and configured at the Web Server level such as IIS (5) and Apache (6).

Siteminder doesn't have a direct and specific configuration to implement:

• Content Security Policy (CSP). Follow the guidance from Mozilla (7);
• X-XSS-protection header (8), but it generally has some configurations to limit the scope of XSS (9);
• Strict-transport-security (10),  some configurations to help make the integration more secure (11);
• X-Content-Type-Options (12).

 

Additional Information

 

1. Content-Security-Policy (CSP)
   
   
2. X-XSS-Protection - Preventing Cross-Site Scripting Attacks
   
   
3. Strict-Transport-Security
   
   
4. X-Content-Type-Options
   
   
5. Custom Headers <customHeaders>
   
   
6. Apache Module mod_headers
    
7. Content-Security-Policy
    
8. X-XSS-Protection
    
9. Vulnerability 6  : Format String Attack
    
10. Strict-Transport-Security
    
    
11. Implementing HSTS on Federation SPS
    
    
12. X-Content-Type-Options