Vulnerability in Tomcat config under Confluence - QID 11827
Asked by Lloyd Chandler:

```
Our Confluence server was flagged by Qualys scan for the 11827 vulnerability. 
The following headers are not present:

Header set X-Content-Type-Options: "nosniff"Header set X-XSS-Protection: "1; mode=block"Header set X-Frame-Options: "sameorigin"

As we are using the default Confluence installation which is using Apache Tomcat (built in or something),
how do I add these headers to the default config?
```


Answers:
author: Timothy
body: While the other comment by [@Edwin Kyalangalilwa](/t5/user/viewprofilepage/user-id/255918)is good, you should also consider "masking" this vulnerability by fronting your Tomcat with a proxy server in front of it. For example, Apache:

* <https://www.linux.org/threads/fixing-http-security-header-not-detected.12462/>
* <https://www.keycdn.com/blog/http-security-headers/>

There is no easy way to upgrade Tomcat that run's Jira and Confluence. So, the best workaround is to mask whatever's running in the background with a good proxy and webserver setup.


author: Edwin Kyalangalilwa
body: Hi Lloyd,

This link will be helpful. Refers to web.xml

<https://geekflare.com/tomcat-http-security-header/>

comments: author: Lloyd Chandler
body: thanks - looked at that reference and another - I made the correct changes to the web.xml file located under ..\\confluence\\conf - however, after making the changes, it's still not working - the headers are not appearing..

I updated web.xml to contain the following - uncommented:

    <filter>        <filter-name>httpHeaderSecurity</filter-name>        <filter-class>org.apache.catalina.filters.HttpHeaderSecurityFilter</filter-class>        <async-supported>true</async-supported>        <init-param>          <param-name>antiClickJackingEnabled</param-name>          <param-value>true</param-value>        </init-param>        <init-param>          <param-name>antiClickJackingOption</param-name>          <param-value>SAMEORIGIN</param-value>        </init-param>    </filter>  <filter-mapping>     <filter-name>httpHeaderSecurity</filter-name>     <url-pattern>/*</url-pattern></filter-mapping>


author: Edwin Kyalangalilwa
body: Did you try restarting after the changes?


author: Lloyd Chandler
body: yep - if that means restarting the Confluence service..reboot, no..


author: Lloyd Chandler
body: I've also found that there are 3 web.xml files on the system - not sure why and which to change..


author: Edwin Kyalangalilwa
body: That's the correct location. A reboot is required for changes to take effect.


author: Lloyd Chandler
body: Reboot doesn't change anything - still doesn't work. I don't understand. I've made those exact line changes in web.xml. Here's the locations I have found this file:

1. D:\\confluence\\confluence\\conf

2. D:\\confluence\\confluence\\confluence\\WEB-INF

3. D:\\confluence\\confluence\\synchrony-proxy\\WEB-INF

Made the change on number 1. Number 2 and 3 files look different than web.xml in #1 location, so not sure what to do here.


author: Timothy
body: Item 2 is where you want to make the change. And only in Item 2.
> 2. D:\\confluence\\confluence\\confluence\\WEB-INF


author: Lloyd Chandler
body: ok - so the one in 2 is strange as it doesn't have these entries even commented out, like the web.xml in #1 does - so do I just add them anywhere? I've seen some references that it must be in certain areas (before or after other entries). I've also seen where filter mapping entry should be before the filter.


author: Timothy
body: > Item 2 is where you want to make the change. And only in Item 2.

I may stand corrected on this.
> I've seen some references that it must be in certain areas (before or after other entries). I've also seen where filter mapping entry should be before the filter.

There are orders in the filters:

* <http://www.thejavageek.com/2013/11/20/filter-order-servlets/>


Tags: jira