Web XFS Prevention (v9.1)

Product	ILLiad
Version	9.1
Ticket	N/A

Purpose/Scope

The ILLiad 9.1.1 point release was issued to fix how ILLiad handles the HTTP headers to mitigate the potential risk of cross-frame scripting (XFS) in the ILLiad 9.1 web pages.

 

Two Customization Keys (HttpXFrameOptionsHeader and HttpContentSecurityPolicyHeader) were added to help define how ILLiad runs inside HTML frames to prevent vulnerabilities where the attacker hosts the target site in an iframe to intercept mouse clicks or keystrokes. The two customization keys each specify a header returned by the webserver to provide protection from such attacks for users on older browsers. Alternatively, the headers can be added as a policy for the entire server by the server admin.

• frame-ancestors 'none';- The web page will not be displayed at all if it is in a frame. This is the default option when the key is added.
• frame-ancestors 'self';- If the web page is loaded in a frame, it will be displayed only if its frame was loaded from the same origin.
• frame-ancestors{uri};- If the web page is loaded in a frame, it will be displayed only if its form was loaded from the specified URL. 

Combining Key Values

The Content-Security-Policy header values can be combined (e.g., 'none' and 'self') to add more refined restrictions. For example, if ILLiad returns a frame-ancestors directive of 'self' but the webserver administrator has the server return a directive of 'none', the most restrictive policy will take effect.

Example

If the HttpContentSecurityPolicyHeader key is set to a frame-ancestor policy of 'self' and the server admin sets a frame-ancestor policy of https://example.com, the browser will combine these directives and allow the page to be served in an iframe that originates from either the same domain (self) or from example.com.

If the Key is Left Blank

If the HttpContentSecurityPolicyHeader customization key is blank, the header will default to frame-ancestors 'none'. This prevents ILLiad from ignoring the X-Frame-Options headers set at the web server level because ILLiad will first check for the value of HttpContentSecurityPolicyHeader before checking the value of the HttpXFrameOptionsHeader.

The customization key HttpXFrameOptionsHeader will add the X-Frame-Options header to responses from the ILLiad web server. These options are obsoleted by the frame-ancestor directives. The range of values for this key are described below to support older browsers if necessary: