This issue aims to increase security by changing the default behavior of the PVCS Version Manager Application Server as follows: Enable Anti- ClickJacking . Disable the Axis 2 administrative interface.
The following steps will enable HSTS as well as a few other settings related to XSS attacks, content sniffing, and clickjacking for SBM 10.x: Step 1: JBoss Configuration
This is NOT a recommended configuration change because it makes a Pulse installation less secure (other pages will be able to frame Pulse which could lead to clickjacking attacks -- see https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-Frame-Options ).
For customers using Firefox, Chrome or Microsoft Edge browsers, a Content-Security-Policy response header can be used to protect the SBM site from being embedded in another Web site, while still allowing it to be embedded in specific Web sites. This essentially creates a white-list of allowed sites that customers can easily specify. Preventing SBM from being embedded in another Web site prevents ClickJack attacks from occurring (see https://www.owasp.org/index.php/ Clickjacking
Summary (DEF276411 and DEF276415) In addition, rules that filter requests based on invalid shell parameters and XSS prevention for the name and description of Work Center feeds have been added to the default configuration. Prevent ClickJack attacks on the Login Page (DEF272156)
