Security Headers

Security Headers

As of Unified Workspace 7.0 HTTP Headers can be added to UW responses.

We suggest adding the following Security Headers.

Header
Value
Content-Security-Policy
default-src https: 'unsafe-eval' 'unsafe-inline'; object-src 'none'; img-src 'self' data:
Permissions-Policy
autoplay=(), encrypted-media=(), fullscreen=(self), payment=()
Referrer-Policy
strict-origin-when-cross-origin
X-Content-Type-Options
nosniff
X-Frame-Options
sameorigin
X-Xss-Protection
1; mode=block
Strict-Transort-Security
max-age=31536000; includeSubDomains

The HTTP Headers are added to the Login Policy object:
  1. Open the webAdmin Dashboard
  2. Expand Tree Root
  3. Browse to the DefaultLoginPolicy
  4. Add the listed headers to the HTTP Header(s) field
    1. Click the +
    2. Enter the Header Name and Value
    3. Click OK
  5. Click the Save button

The webNetwork service needs to be restarted on each relay server for it to begin adding the headers.