com.atlassian.jira.web.filters.steps.security

Class HttpSecurityConfig

java.lang.Object

com.atlassian.jira.web.filters.steps.security.HttpSecurityConfig

@Component
 @ThreadSafe
public class HttpSecurityConfig
extends Object

Configuration for applying HTTP Security Headers, here: X_FRAME_OPTIONS and CONTENT_SECURITY_POLICY which may prevent clickjacking attacks but also blocks resources to be embedded in iframes (etc). This could be not desired, e.g. by issue collector.

Clickjacking protection can be disabled by setting system property to "true".

One can exclude paths from clickjacking protection in two ways. Either way, a path will be matched against all requests, whose path starts with any of the provided path (by means of String.startsWith(String)). A path comprises of servlet path and path info, if available.
Firstly, there is a `<clickjacking-http-headers-excluded-paths>` plugin module descriptor, which can be add to `atlassian-plugin.xml`. Use `<path>...</path>` elements in order to declare paths.
Secondly, one can specify a -separated list of paths in system property.

Since:

7.6

Constructor Summary

Constructors

Constructor and Description
HttpSecurityConfig(JiraProperties jiraProperties, com.atlassian.plugin.PluginAccessor pluginAccessor)

Method Summary

Modifier and Type	Method and Description
String	getStrictTransportSecurityAdditionalParams()
Long	getStrictTransportSecurityMaxAge()
boolean	isClickjackingProtectionDisabled()
boolean	isExcluded(String path)
boolean	isStrictTransportSecurityDisabled()
boolean	isStrictTransportSecurityIncludeSubDomainsEnabled()
boolean	isStrictTransportSecurityPreloadEnabled()

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Constructor Detail

HttpSecurityConfig

@Autowired
public HttpSecurityConfig(JiraProperties jiraProperties,
                                     com.atlassian.plugin.PluginAccessor pluginAccessor)

Method Detail

isClickjackingProtectionDisabled

public boolean isClickjackingProtectionDisabled()

isStrictTransportSecurityDisabled

public boolean isStrictTransportSecurityDisabled()

isStrictTransportSecurityPreloadEnabled

public boolean isStrictTransportSecurityPreloadEnabled()

isStrictTransportSecurityIncludeSubDomainsEnabled

public boolean isStrictTransportSecurityIncludeSubDomainsEnabled()

getStrictTransportSecurityMaxAge

public Long getStrictTransportSecurityMaxAge()

getStrictTransportSecurityAdditionalParams

public String getStrictTransportSecurityAdditionalParams()

isExcluded

public boolean isExcluded(String path)