Missing HTTP Security response Headers

Products

• CA Release Automation - Release Operations Center (Nolio)

Issue/Introduction

We want to introduce below response headers in all HTTP request based on the request from vulnerability team. Please share the steps to implement the changes.

Properties are 

Strict-Transport-Security: max-age=31536000;includeSubDomains;preload

X-Content-Type-Options: nosniff

X-Frame-Options: SAMEORIGIN

X-Permitted-Cross-Domain-Policies: master-only

X-XSS-Protection: 1;mode=block

 

Security scan could detect the vulnerability CWE-693 :

CWE-693: Protection Mechanism Failure mentions the following - The product does not use or incorrectly uses a protection mechanism that provides sufficient defense against directed attacks against the product. 
A "missing" protection mechanism occurs when the application does not define any mechanism against a certain class of attack. 
An "insufficient" protection mechanism might provide some defenses - for example, against the most common attacks - but it does not protect against everything that is intended. 
Finally, an "ignored" mechanism occurs when a mechanism is available and in active use within the product, but the developer has not applied it in some code path. 

Customers are advised to set proper X-Content-Type-Options (https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-Content-Type-Options) 
and Strict-Transport-Security (https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Strict-Transport-Security) HTTP response headers. 

Depending on their server software, customers can set directives in their site configuration or Web.config files. Few examples are: 
X-Content-Type-Options: 
Apache: Header always set X-Content-Type-Options: nosniff 
HTTP Strict-Transport-Security: 
Apache: Header always set Strict-Transport-Security "max-age=31536000; includeSubDomains" 
Nginx: add_header Strict-Transport-Security max-age=31536000; 
 Note: Network devices that include a HTTP/HTTPS console for administrative/management purposes often do not include all/some of the security headers. This is a known issue and it is recommend to contact the vendor for a solution.

 

Environment

Release : 6.8

Resolution

1- Do a backup of file <nolio_dir>/conf/web.xml

 

cd <nolio_dir>/conf

cp web.xml web.xml.bak

 

 

2- Edit file web.xml

Look for filter httpHeaderSecurity (line #504)

Uncomment the section and add the init-param

 

Before

<!--
     <filter>
         <filter-name>httpHeaderSecurity</filter-name>
         <filter-class>org.apache.catalina.filters.HttpHeaderSecurityFilter</filter-class>
         <async-supported>true</async-supported>
     </filter>
-->

 

After

     <filter>
         <filter-name>httpHeaderSecurity</filter-name>
         <filter-class>org.apache.catalina.filters.HttpHeaderSecurityFilter</filter-class>
         <async-supported>true</async-supported>

         <init-param>
                <param-name>antiClickJackingOption</param-name>
                <param-value>SAMEORIGIN</param-value>
         </init-param>
     </filter>

 

 

 

3- Look for again httpHeaderSecurity. There is the filter-mapping for httpHeaderSecurity at line #604

Uncomment this section.

 

Before

 <!--
     <filter-mapping>
         <filter-name>httpHeaderSecurity</filter-name>
         <url-pattern>/*</url-pattern>
         <dispatcher>REQUEST</dispatcher>
     </filter-mapping>
-->

 

After 

    <filter-mapping>
         <filter-name>httpHeaderSecurity</filter-name>
         <url-pattern>/*</url-pattern>
         <dispatcher>REQUEST</dispatcher>
     </filter-mapping>

 

 

 

4- Save the modification in web.xml and restart RA service.