Adding X-FRAME-OPTIONS to response on AEM 6.2 | Community
Skip to main content
svenancio-3shar
svenancio-3shar
Level 2
Mar 10, 2017 3:42 PM UTC
Solved

Adding X-FRAME-OPTIONS to response on AEM 6.2

Hi guys, 

In AEM 6.2 release notes it says AEM has capability of adding X-FRAME-OPTIONS to response headers.

This is what is in docs:

  • Added configurable X-FRAME-OPTIONS header to avoid click-jacking

The documentation doesnt state where that can be configured.

Where can I configure that? On OSGI?

Thanks.        

    This post is no longer active and is closed to new replies. Need help? Start a new post to ask your question.
    svenancio-3shar
    svenancio-3sharAccepted solution
    Level 2
    Mar 14, 2017 1:04 PM UTC

    Hi guys, 

    Follows what Adobe responded:

    Could you please open this page [1] and review the property "Additional response headers"? Add the value "X-Frame-Options=SAMEORIGIN" and validate.

                Let me know if you have any question.

                [1] http://<host>:<port>/system/console/configMgr/org.apache.sling.engine.impl.SlingMainServlet

    Also , an image of the configuration:

    https://www.screencast.com/t/1Tf6AAZGaAG

    Hope that helps community.

    Tks.

    View reply

    5 replies

    rubenf42159101
    rubenf42159101
    Level 2
    Sep 7, 2017 12:30 PM UTC

    Hi,

    I have followed the instructions updated by you. But AEM still shows warn message in Operations Dashboard.

    Kindly let me know if I need to configure else where in AEM to close this warn message in Operations Dashboard.

    Note: I'm using AEM 6.1 with SP2 + CFP9

    Thanks and Regards,

    Ruben Fernando

    Translate
    svenancio-3shar
    svenancio-3sharAuthorAccepted solution
    Level 2
    Mar 14, 2017 1:04 PM UTC

    Hi guys, 

    Follows what Adobe responded:

    Could you please open this page [1] and review the property "Additional response headers"? Add the value "X-Frame-Options=SAMEORIGIN" and validate.

                Let me know if you have any question.

                [1] http://<host>:<port>/system/console/configMgr/org.apache.sling.engine.impl.SlingMainServlet

    Also , an image of the configuration:

    https://www.screencast.com/t/1Tf6AAZGaAG

    Hope that helps community.

    Tks.

    Translate
      kautuk_sahni
      kautuk_sahni
      Employee
      Mar 14, 2017 9:07 AM UTC

      Hi 

      Please do Share this this the community for future references.

      ~kautuk

      Translate
      Kautuk Sahni
      svenancio-3shar
      svenancio-3sharAuthor
      Level 2
      Mar 13, 2017 3:54 PM UTC

      Thanks Scott.

      I will file a ticket and check the right approach.

      Rgds,    

      Translate
      smacdonald2008
      smacdonald2008
      Level 10
      Mar 13, 2017 3:40 PM UTC

      I found this:

      To prevent clickjacking we recommend that you configure your webserver to provide the X-FRAME-OPTIONS HTTP header set to SAMEORIGIN.

      For more information on clickjacking please see the OWASP site.

      Which points to https://www.owasp.org/index.php/Clickjacking

      Looks like this is configured at the web server level. 

      Translate
      Terms & ConditionsAccessibility statement

      Loading footer...