WebSphere Application Server & Liberty

WebSphere Application Server & Liberty

Join this online group to communicate across IBM product users and experts by sharing advice and best practices with peers and staying up to date regarding product enhancements.

 View Only

  • 1.  Setting Security Headers on WAS 7

    Posted 05/20/22 03:51 PM
    I've been searching for a way to update security headers for a ear/war application hosted on WAS 7.  I don't have IBM Http Server available to me.  I was wondering if the only way to set the Security Headers is through the ear/war application.  Any assistance or directing or resource would be appreciated.

    ------------------------------
    Cesar Garcia
    ------------------------------


  • 2.  RE: Setting Security Headers on WAS 7

    Posted 05/23/22 02:33 AM
    Hello Cesar,

    Are you talking about security header like these? I usually confgure this type of security headers at Web server/Proxy level.

    - Strict-Transport-Security
    - Content-Security-Policy
    - X-XSS-Protection
    - X-Frame-Options "SAMEORIGIN";
    - X-Content-Type-Options nosniff;
    - Referrer-Policy "strict-origin";
    - Permissions-Policy

    Regards,

    ------------------------------
    Gabriel Aberasturi
    Versia tecnologias emergentes
    ------------------------------



  • 3.  RE: Setting Security Headers on WAS 7

    Posted 05/24/22 09:50 AM
    Hello Gabriel,

    Yes, these are the headers I'm looking at.  I didn't see anywhere on WAS 7 that you could set these.  I thought you had to install the IBM Http Server to be able to set these.  Can you confirm if this is possible on WAS 7 alone.  

    Cesar

    ------------------------------
    Cesar Garcia
    ------------------------------

    Original Message


  • 4.  RE: Setting Security Headers on WAS 7

    Posted 05/24/22 10:50 AM
    Cesar,

    We have at web server level this type of security configurations.

    Here and example for nginx and apache, IBM HTTP Server (IHS) is based on apache but not sure if will work.

    https://webdock.io/en/docs/how-guides/security-guides/how-to-configure-security-headers-in-nginx-and-apache

    Maybe as @Brian S Paskin pointed some headers could be set at WAS level and the others at web server level.

    I have found this example don't look the product but the IHS configuration that have the security headers configured. Take in mind IHS version.

    https://www.ibm.com/docs/en/siffs/2.0.2?topic=in-configuring-http-server-websphere-plug

    Hope this helps.

    Regards ​

    ------------------------------
    Gabriel Aberasturi
    Versia tecnologias emergentes
    ------------------------------

    Original Message


  • 5.  RE: Setting Security Headers on WAS 7

    Posted 05/23/22 04:48 AM
    Hi, there are certain headers that can be turned on with tWAS, but not all. You can programmatically return whichever header you like using the HttpServletResponse.addHeader(key, value).

    Brian

    ------------------------------
    Brian S Paskin
    Sr. Cloud Engineer
    IBM Cloud Engineering
    ------------------------------



  • 6.  RE: Setting Security Headers on WAS 7

    Posted 05/24/22 09:52 AM
    Hello Brian,

    Thanks for your response.  This is what I'm understanding but just wanted to be sure I wasn't missing anything on WAS 7.  Thanks.

    Cesar

    ------------------------------
    Cesar Garcia
    ------------------------------

    Original Message