You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@cxf.apache.org by co...@apache.org on 2019/02/19 12:11:05 UTC
[cxf-fediz] branch 1.4.x-fixes updated: Adding various security
headers for the IdP
This is an automated email from the ASF dual-hosted git repository.
coheigea pushed a commit to branch 1.4.x-fixes
in repository https://gitbox.apache.org/repos/asf/cxf-fediz.git
The following commit(s) were added to refs/heads/1.4.x-fixes by this push:
new 68f1280 Adding various security headers for the IdP
68f1280 is described below
commit 68f128098c043f6430b832082fad087808cd7c8e
Author: Colm O hEigeartaigh <co...@apache.org>
AuthorDate: Tue Feb 19 12:10:36 2019 +0000
Adding various security headers for the IdP
---
.../webapp/WEB-INF/config/security-clientcert-config.xml | 12 ++++++++++++
.../main/webapp/WEB-INF/config/security-krb-config.xml | 12 ++++++++++++
.../src/main/webapp/WEB-INF/config/security-rs-config.xml | 6 ++++++
.../src/main/webapp/WEB-INF/config/security-up-config.xml | 12 ++++++++++++
services/idp/src/main/webapp/WEB-INF/security-config.xml | 15 ++++++++++++++-
5 files changed, 56 insertions(+), 1 deletion(-)
diff --git a/services/idp/src/main/webapp/WEB-INF/config/security-clientcert-config.xml b/services/idp/src/main/webapp/WEB-INF/config/security-clientcert-config.xml
index fc436ad..53fc270 100644
--- a/services/idp/src/main/webapp/WEB-INF/config/security-clientcert-config.xml
+++ b/services/idp/src/main/webapp/WEB-INF/config/security-clientcert-config.xml
@@ -44,6 +44,12 @@
<security:x509 />
<security:logout delete-cookies="FEDIZ_HOME_REALM" invalidate-session="true" />
+
+ <security:headers>
+ <security:content-type-options />
+ <security:frame-options />
+ <security:xss-protection />
+ </security:headers>
</security:http>
<!-- SSL Client Cert entry point for SAML SSO -->
@@ -54,6 +60,12 @@
<security:x509 />
<security:logout delete-cookies="FEDIZ_HOME_REALM" invalidate-session="true" />
+
+ <security:headers>
+ <security:content-type-options />
+ <security:frame-options />
+ <security:xss-protection />
+ </security:headers>
</security:http>
<bean id="stsClientCertPortFilter" class="org.apache.cxf.fediz.service.idp.STSPortFilter">
diff --git a/services/idp/src/main/webapp/WEB-INF/config/security-krb-config.xml b/services/idp/src/main/webapp/WEB-INF/config/security-krb-config.xml
index c5dddd8..826c032 100644
--- a/services/idp/src/main/webapp/WEB-INF/config/security-krb-config.xml
+++ b/services/idp/src/main/webapp/WEB-INF/config/security-krb-config.xml
@@ -52,6 +52,12 @@
<security:custom-filter ref="kerberosAuthenticationProcessingFilter" position="BASIC_AUTH_FILTER" />
<security:logout delete-cookies="FEDIZ_HOME_REALM" invalidate-session="true" />
+
+ <security:headers>
+ <security:content-type-options />
+ <security:frame-options />
+ <security:xss-protection />
+ </security:headers>
</security:http>
<security:http pattern="/saml/krb" use-expressions="true" entry-point-ref="kerberosEntryPoint">
@@ -61,6 +67,12 @@
<security:custom-filter ref="kerberosAuthenticationProcessingFilter" position="BASIC_AUTH_FILTER" />
<security:logout delete-cookies="FEDIZ_HOME_REALM" invalidate-session="true" />
+
+ <security:headers>
+ <security:content-type-options />
+ <security:frame-options />
+ <security:xss-protection />
+ </security:headers>
</security:http>
<bean id="stsKrbPortFilter" class="org.apache.cxf.fediz.service.idp.STSPortFilter">
diff --git a/services/idp/src/main/webapp/WEB-INF/config/security-rs-config.xml b/services/idp/src/main/webapp/WEB-INF/config/security-rs-config.xml
index aa859b5..c739a00 100644
--- a/services/idp/src/main/webapp/WEB-INF/config/security-rs-config.xml
+++ b/services/idp/src/main/webapp/WEB-INF/config/security-rs-config.xml
@@ -41,6 +41,12 @@
<security:custom-filter after="SERVLET_API_SUPPORT_FILTER" ref="entitlementsEnricher" />
<security:intercept-url pattern="/services/rs/**" access="isAuthenticated()" />
<security:http-basic />
+
+ <security:headers>
+ <security:content-type-options />
+ <security:frame-options />
+ <security:xss-protection />
+ </security:headers>
</security:http>
<bean id="bCryptPasswordEncoder" class="org.springframework.security.crypto.bcrypt.BCryptPasswordEncoder" />
diff --git a/services/idp/src/main/webapp/WEB-INF/config/security-up-config.xml b/services/idp/src/main/webapp/WEB-INF/config/security-up-config.xml
index e655065..284504d 100644
--- a/services/idp/src/main/webapp/WEB-INF/config/security-up-config.xml
+++ b/services/idp/src/main/webapp/WEB-INF/config/security-up-config.xml
@@ -58,6 +58,12 @@
delete-cookies="FEDIZ_HOME_REALM,JSESSIONID"
invalidate-session="true"
/>
+
+ <security:headers>
+ <security:content-type-options />
+ <security:frame-options />
+ <security:xss-protection />
+ </security:headers>
</security:http>
<!-- HTTP/BA entry point for SAML SSO -->
@@ -79,6 +85,12 @@
delete-cookies="FEDIZ_HOME_REALM,JSESSIONID"
invalidate-session="true"
/>
+
+ <security:headers>
+ <security:content-type-options />
+ <security:frame-options />
+ <security:xss-protection />
+ </security:headers>
</security:http>
<bean id="stsUPPortFilter" class="org.apache.cxf.fediz.service.idp.STSPortFilter">
diff --git a/services/idp/src/main/webapp/WEB-INF/security-config.xml b/services/idp/src/main/webapp/WEB-INF/security-config.xml
index da92d66..a270050 100644
--- a/services/idp/src/main/webapp/WEB-INF/security-config.xml
+++ b/services/idp/src/main/webapp/WEB-INF/security-config.xml
@@ -57,12 +57,25 @@
<security:custom-filter after="CHANNEL_FILTER" ref="stsUPPortFilter" />
<security:custom-filter after="SERVLET_API_SUPPORT_FILTER" ref="entitlementsEnricher" />
<security:intercept-url pattern="/FederationMetadata/2007-06/FederationMetadata.xml" access="isAnonymous() or isAuthenticated()" />
+
+ <security:headers>
+ <security:content-type-options />
+ <security:frame-options />
+ <security:xss-protection />
+ </security:headers>
+
</security:http>
<!-- Main entry point for SAML SSO -->
<security:http pattern="/saml" use-expressions="true" entry-point-ref="fedizEntryPoint">
<security:custom-filter after="CHANNEL_FILTER" ref="stsUPPortFilter" />
<security:custom-filter after="SERVLET_API_SUPPORT_FILTER" ref="entitlementsEnricher" />
+
+ <security:headers>
+ <security:content-type-options />
+ <security:frame-options />
+ <security:xss-protection />
+ </security:headers>
</security:http>
<security:authentication-manager alias="authenticationManagers">
@@ -76,5 +89,5 @@
<bean id="commonsURLValidator"
class="org.apache.cxf.fediz.service.idp.beans.CommonsURLValidator" />
-
+
</beans>