Package com.atlassian.jira.web.filters.steps.security

Class HttpSecurityStep

java.lang.Object

com.atlassian.jira.web.filters.steps.security.HttpSecurityStep

All Implemented Interfaces:

FilterStep

public class HttpSecurityStep
extends Object
implements FilterStep

Sets the following security headers on each HTTP response:

• REFERRER-POLICY
with "strict-origin-when-cross-origin"
• X_XSS_PROTECTION with "1; mode=block"
• X_CONTENT_TYPE_OPTIONS with "nosniff"
• X_FRAME_OPTIONS with "SAMEORIGIN"
• CONTENT_SECURITY_POLICY with "frame-ancestors \'self\'"

While the last two (X_FRAME_OPTIONS, CONTENT_SECURITY_POLICY) are about preventing clickjacking attacks, but also blocks resources to be embedded in iframes (etc). This could be not desired, e.g. by issue collector. There's a way to exclude resources from clickjacking protection. For details see HttpSecurityConfig.
During the setup HttpSecurityConfig is not present, so that each HTTP response will contain clickjacking protection.
All assets will have clickjacking protection as well.

Since:

7.6

Constructor Summary

Constructors

Constructor	Description
HttpSecurityStep()

Method Summary

Modifier and Type	Method	Description
FilterCallContext	beforeDoFilter(FilterCallContext context)	This is called to before the filterChain.doFilter() method is called
FilterCallContext	finallyAfterDoFilter(FilterCallContext context)	This is called after the filterChain.doFilter() method is called in a finally {} block

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Constructor Details

HttpSecurityStep

public HttpSecurityStep()

Method Details

beforeDoFilter

public FilterCallContext beforeDoFilter(FilterCallContext context)

Description copied from interface: FilterStep

This is called to before the filterChain.doFilter() method is called

Specified by:

beforeDoFilter in interface FilterStep

Parameters:

context - the context of the filter step call

finallyAfterDoFilter

public FilterCallContext finallyAfterDoFilter(FilterCallContext context)

Description copied from interface: FilterStep

This is called after the filterChain.doFilter() method is called in a finally {} block

Specified by:

finallyAfterDoFilter in interface FilterStep

Parameters:

context - the context of the filter step call