Securing Jaggery Applications

This section explains how to minimize the security threats to the Jaggery applications that are hosted within your WSO2 DAS pack. This is achieved via headers that can be embedded in the HTTP responses of these applications.

Available headers

The following is a list of headers that need to be enabled to enhance the security aspects of Jaggery Applications.

Header	Purpose
`X-XSS-Protection: 1; mode=block`	This enables reflected XSS protection in supported web browsers.
`X-Content-Type-Options: nosniff`	This disables mime sniffing that can result in reflected or stored XSS in certain browsers.
`Cache-Control: no-store, no-cache, must-revalidate, private`	This prevents sensitive information from being cached in web browsers, proxies and other intermediate network devices.

In addition, the following are headers that need to be enabled based on the requirement of the application. These headers can be customized based on the URL pattern.

Header	Purpose
`X-Frame-Options: DENY`	This disables embedding Jaggery apps in iframes or frames.
`X-Frame-Options: SAMEORIGIN`	This allows you to embed Jaggery apps in iframes or frames within the same origin.

The X-Frame-Options header mitigates the clickjacking attacks. Out-of-the-box Jaggery applications need to use the SAMEORIGIN option. The DENY option should not be used because some out-of-the-box dashboards may use framing. If an application that resides outside the origin needs to frame a Jaggery app, then the X-Frame-Options header must not be returned at all. This must be configured as per application requirement, taking the security risk into consideration.

Enabling a header

To apply the basic security headers required to secure Jaggery applications, update the <DAS_HOME>/repository/deployment/server/jaggeryapps/<app-name>/jaggery.conf file as shown in the steps below.

Note the following about the configurations below:

These configurations enable the Strict-Transport-Security: max-age=15768000; includeSubDomains header for additional security. This header prevents any communication over HTTP from taking place for the number of milliseconds specified via the max-age parameter, starting from the time the latest response with the aforementioned header was received.
Enabling these headers may cause some inconvenience in a developer environment where URLs and certificates change. This happens when some browsers do not forget the preference of that domain unrtil the time specified via the max-age parameter has elapsed, even when the browser cache is cleared.Therefore, it is recommended to enable these headers in only the production and staging environments.

These headers are required for the production and staging environments for additional security.

For development environments:

Add the two filters named HttpHeaderSecurityFilter and ContentTypeBasedCachePreventionFilter in the "filters": [] section as shown below.

"filters":[
  {
    "name":"HttpHeaderSecurityFilter",
    "class":"org.apache.catalina.filters.HttpHeaderSecurityFilter",
    "params" : [
        {"name" : "hstsEnabled", "value" : "false"},
                    { "name": "antiClickJackingOption", "value": "SAMEORIGIN" }
 	     ]
  },
  {
    "name": "ContentTypeBasedCachePreventionFilter",
    "class": "org.wso2.carbon.ui.filters.cache.ContentTypeBasedCachePreventionFilter",
    "params":[
      {"name": "patterns", "value": "text/html\" ,application/json\" ,plain/text"},
      {"name": "filterAction", "value": "enforce"},
      {"name": "httpHeaders", "value": "Cache-Control: no-store, no-cache, must-revalidate, private"}
    ]
  }
],

Add the filter mappings for the two filters you added. These two filter mapping configurations need to be added in the "filterMappings":[] as shown below.

"filterMappings":[
  {
    "name":"HttpHeaderSecurityFilter", 
    "url":"*"
  },
  {
    "name": "ContentTypeBasedCachePreventionFilter",
    "url": "*"
  }
]

Save your changes.

For production environments:

Add the two filters named HttpHeaderSecurityFilter and ContentTypeBasedCachePreventionFilter in the "filters": [] section as shown below.

"filters": [
    {
        "name": "HttpHeaderSecurityFilter",
        "class": "org.apache.catalina.filters.HttpHeaderSecurityFilter",
        "params": [
	  {"name": "hstsMaxAgeSeconds",  "value": "15768000"},
              { "name": "antiClickJackingOption", "value": "SAMEORIGIN" }
        ]
     },
     {
        "name": "ContentTypeBasedCachePreventionFilter",
        "class": "org.wso2.carbon.ui.filters.cache.ContentTypeBasedCachePreventionFilter",
        "params":  [
	{ "name": "patterns", "value": "text/html\" ,application/json\" ,plain/text" },
	{ "name": "filterAction", "value": "enforce"},
	{ "name": "httpHeaders", "value": "Cache-Control: no-store, no-cache, must-revalidate, private" }
        ]
    }
],

Add the filter mappings for the two filters you added. These two filter mapping configurations need to be added in the "filterMappings":[] as shown below.
```
"filterMappings": [
    { "name": "HttpHeaderSecurityFilter", "url": "*" },
    { "name": "ContentTypeBasedCachePreventionFilter", "url": "*"}
]
```
Save your changes.