Join the Customer Advisory Board

WebSphere & Liberty CAB

Join this online group to communicate across IBM product users and experts by sharing advice and best practices with peers and staying up to date regarding product enhancements.

 View Only
Back to discussions
Expand all | Collapse all

MISCONFIGURED SECURITY HEADERS

  • 1.  MISCONFIGURED SECURITY HEADERS

    Posted 2 days ago

    Dear Team

    How do we configure missing HTTP Header on TWAS 9.0.5.x

    The headers should be set as follows
    - Set the X-XSS header as follows: X-XSS-Protection: 1;mode=block
    This enables the filter and instructs the browser to block the entire page if an XSS attack is detected. This is more secure than just 1.

    MISCONFIGURED SECURITY HEADERS
    The web application does not have the security headers set correctly:
    - Cross Site Scripting Protection (X-XSS): This protects against Cross-Site Scripting attacks sniffing.
    X-XSS-Protection: 1; This enables the browser's XSS filter but does not block the page if an attack is detected.

    Thanks



    ------------------------------
    Adeoye Omoboya
    ------------------------------


Related Content