Forum Discussion

stupid48's avatar
stupid48
Icon for Altocumulus rankAltocumulus
Mar 02, 2023

ASM: Need to add HTTP security headers for response and blocking pages

Hi there, We are needing to turn on security headers for ASM response and blocking pages.  There is a KB (K25232031 ) that mentions it being enabled by default for version 16.0.0. We are running a ...
security
Juergen_Mang's avatar
Juergen_Mang
Icon for MVP rankMVP
Mar 03, 2023

K25232031  is interesting, thanks for the link.

About X-XSS-Protection: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-XSS-Protection
About X-Frame-Options: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-Frame-Options

Adding a simple Content-Security-Policy will be the better way. I do not tested it, but this shoud suffice:

 

Content-Security-Policy: default-src 'self'; frame-ancestors 'self'

 

P.S.: I always change the Response Code to 403