Configure Service HTTP Security Headers
CAS has ability to control, on a per-service basis, whether certain security-related HTTP headers should be injected into the response. While headers are typically enabled and defined globally as part of the CAS Security Filter, the strategy described here allows one to disable/enable the injection of these headers for certain applications and service requests and override the global defaults.
A sample JSON file follows:
1
2
3
4
5
6
7
8
9
10
11
12
13
{
"@class" : "org.apereo.cas.services.RegexRegisteredService",
"serviceId" : "^https://.+",
"name" : "sample service",
"id" : 100,
"properties" : {
"@class" : "java.util.HashMap",
"httpHeaderEnableXContentOptions" : {
"@class" : "org.apereo.cas.services.DefaultRegisteredServiceProperty",
"values" : [ "java.util.HashSet", [ "true" ] ]
}
}
}
Supported HTTP headers in form of service properties are:
Header | Description |
---|---|
httpHeaderEnableCacheControl |
Insert Cache-Control headers into the response for this service. |
httpHeaderEnableXContentOptions |
Insert X-Content-Type-Options headers into the response for this service. |
httpHeaderEnableStrictTransportSecurity |
Insert Strict-Transport-Security headers into the response for this service. |
httpHeaderEnableXFrameOptions |
Insert X-Frame-Options headers into the response for this service. |
httpHeaderEnableContentSecurityPolicy |
Insert Content-Security-Policy headers into the response for this service. |
httpHeaderEnableXSSProtection |
Insert X-XSS-Protection headers into the response for this service. |
httpHeaderXFrameOptions |
Override the X-Frame-Options header of the response for this service. |
The headers values are picked up from CAS properties. See this guide for relevant settings.