IBM Verify

IBM Verify

Join this online user group to communicate across Security product users and IBM experts by sharing advice and best practices with peers and staying up to date regarding product enhancements.

 View Only

  • 1.  http-rsp-header not returned for Authentication workflows

    Posted 09/13/19 12:37 PM
    Our company does a fortify security scan on our websites before go-live.  The scan returns a high vulnerability for an Authentication workflow for forgot password.  The scan wants the x-frame-options set accordingly.  The following webseal configs work for most everything, but does not seem to return these headers for /mga/sps/authsvc URI stem at all.

    [acnt-mgt]
    http-rsp-header = x-frame-options:TEXT{SAMEORIGIN}
    http-rsp-header = content-security-policy:TEXT{frame-ancestors 'none'}
    http-rsp-header = x-content-type-options:TEXT{nosniff}
    http-rsp-header = x-xss-protection:TEXT{1} 

    Can someone explain why these response headers are missing for auth work flows how do I get this working?

    Thanks

    ------------------------------
    Troy Burkle
    ------------------------------


  • 2.  RE: http-rsp-header not returned for Authentication workflows

    Posted 09/13/19 01:32 PM
    Hello Troy,

    The '[acnt-mgt]' 'http-rsp-header' values are only for ISAM Management page interactions, such as 'login' 'change password' 'login_success'.

    The '/mga/sps/authsvc' is a Junction call to the backend so it is not affected by these headers.

    At 9.0.6.0 you can set the '[rsp-header-names]' on a per-junction level.

    You could resolve your issue like:

    [rsp-header-names:/mga]
    http-rsp-header = x-frame-options:TEXT{SAMEORIGIN}
    http-rsp-header = content-security-policy:TEXT{frame-ancestors 'none'}
    http-rsp-header = x-content-type-options:TEXT{nosniff}
    http-rsp-header = x-xss-protection:TEXT{1}

    Or, you can optionally set those globally for all responses like :

    [rsp-header-names]
    http-rsp-header = x-frame-options:TEXT{SAMEORIGIN}
    http-rsp-header = content-security-policy:TEXT{frame-ancestors 'none'}
    http-rsp-header = x-content-type-options:TEXT{nosniff}
    http-rsp-header = x-xss-protection:TEXT{1}

    ------------------------------
    JACK YARBOROUGH
    ------------------------------



  • 3.  RE: http-rsp-header not returned for Authentication workflows

    Posted 09/13/19 01:37 PM
    Thanks Jack!

    Do I disable the other headers that are currently set then in [acnt-mgt]?

    Troy

    ------------------------------
    Troy Burkle
    ------------------------------

    Original Message


  • 4.  RE: http-rsp-header not returned for Authentication workflows

    Posted 09/13/19 01:32 PM
    Looks like 9060 has an AAC config called sps.doNotSendXFrameOptionsHeader which is set to true.  I can't change that option in the RTSS.  Is there a way for the webseal.conf setting that will override that?

    ------------------------------
    Troy Burkle
    ------------------------------



  • 5.  RE: http-rsp-header not returned for Authentication workflows

    Posted 09/13/19 01:40 PM

    Hello Troy,

    You need both.



    ------------------------------
    JACK YARBOROUGH
    ------------------------------

    Original Message


  • 6.  RE: http-rsp-header not returned for Authentication workflows

    Posted 09/13/19 02:04 PM
    I applied to both and here is my http response headers now (note the http-rsp-header is actually returning in response headers):

    1. cache-control:
      no-cache
    2. content-language:
      en-US
    3. content-type:
      text/html
    4. date:
      Fri, 13 Sep 2019 17:47:52 GMT
    5. expires:
      Thu, 01 Dec 1994 16:00:00 GMT
    6. http-rsp-header:
      x-frame-options:TEXT{SAMEORIGIN}
    7. p3p:
      CP="NON CUR OTPi OUR NOR UNI"
    8. Set-Cookie:
      AMWEBJCT!%2Fmga!JSESSIONID=0000iggEiEWK3JfgajBy3EMl17x:1638s46ld:fa6e69b4-b995-438f-a5f2-411ab2723d68; Path=/; HttpOnly
    9. strict-transport-security:
    10. Strict-Transport-Security:
      max-age=31536000
    11. transfer-encoding:
      chunked

    I tried the global way and specified the mga junction.  Here it is now:

    [rsp-header-names:/mga]
    http-rsp-header = x-frame-options:TEXT{SAMEORIGIN}
    http-rsp-header = content-security-policy:TEXT{frame-ancestors 'none'}
    http-rsp-header = x-content-type-options:TEXT{nosniff}
    http-rsp-header = x-xss-protection:TEXT{1}

    Am I missing something?

    ------------------------------
    Troy Burkle
    ------------------------------

    Original Message


  • 7.  RE: http-rsp-header not returned for Authentication workflows
    Best Answer

    Posted 09/13/19 02:29 PM
    Hello Troy,

    My apologies, I forgot it was different syntax :

    [rsp-header-names:/mga]
    x-frame-options = SAMEORIGIN
    content-security-policy = frame-ancestors 'none'
    x-content-type-options = {nosniff
    x-xss-protection = 1

    Or, you can optionally set those globally for all responses like :

    [rsp-header-names]
    x-frame-options = SAMEORIGIN
    content-security-policy = frame-ancestors 'none'
    x-content-type-options = {nosniff
    x-xss-protection = 1

    ------------------------------
    JACK YARBOROUGH
    ------------------------------

    Original Message


  • 8.  RE: http-rsp-header not returned for Authentication workflows

    Posted 09/13/19 03:07 PM
    Thanks Jake!

    This worked!

    Note however, the syntax with the nosniff option above had a '{' character included which I had to remove.  After I removed that, it worked.

    ------------------------------
    Troy Burkle
    ------------------------------

    Original Message


  • 9.  RE: http-rsp-header not returned for Authentication workflows

    Posted 09/13/19 03:17 PM
    Hello Troy,

    You're welcome.
    Let's make this one the accepted answer :

    The '[acnt-mgt]' 'http-rsp-header' values are only for ISAM Management page interactions, such as 'login' 'change password' 'login_success'.

    The '/mga/sps/authsvc' is a Junction call to the backend so it is not affected by these headers.

    At 9.0.6.0+ you can set the '[rsp-header-names]' on a per-junction level.

    You could resolve your issue like:

    [rsp-header-names:/mga]
    x-frame-options = SAMEORIGIN
    content-security-policy = frame-ancestors 'none'
    x-content-type-options = nosniff
    x-xss-protection = 1

    Or, you can optionally set those globally for all responses like :

    [rsp-header-names]
    x-frame-options = SAMEORIGIN
    content-security-policy = frame-ancestors 'none'
    x-content-type-options = nosniff
    x-xss-protection = 1

    ------------------------------
    JACK YARBOROUGH
    ------------------------------

    Original Message


Related Content