Enable HTTP response headers configuration
Reduce the risk of cookie/session-related hijacking of web apps using a system property.
If the glide.http.headers_config.enabled system property isn't set to true, then response header configurations defined in the HTTP Response Headers [sys_response_header] table aren't used. Security related HTTP response headers include Content Security Policy, which aids in XSS-related protections. For details on HTTP response headers, see http-response-header.
Ensure that the property glide.http.headers_config.enabled is set to true.
More information
| Attribute | Description |
|---|---|
| Configuration name | glide.http.headers_config.enabled |
| Configuration type | System Properties \(/sys\_properties\_list.do\) |
| Data type | Boolean |
| Recommended value | true |
| Default value | true |
| Fallback value | true |
| Category | Session management |
| Security risk | - Severity score: 5.5 - CVSS score: Medium - Security Risk: The security risks of missing, incorrect, or weak HTTP response headers may allow for XSS, CSRF, and cookie/session related hijacking of web apps. |
| Dependencies and prerequisites | None |
Parent Topic:Configuration