Security headers in JIRA
目的
To prevent clickjacking, JIRA adds the X-Frame-Options
and Content-Security-Policy
security headers to each HTTP response. The headers block the content from being embedded in iframes, which might also affect pages that you actually wanted to be displayed this way. If you don't like this change, you can create a list of paths to be excluded from this protection, or disable the security headers entirely.
Security headers
The following headers have been introduced with JIRA 7.6. You can read the original bug report here: - JRASERVER-25143Getting issue details... STATUS
ヘッダー | 値 |
---|---|
X-Frame-Options | SAMEORIGIN |
Content-Security-Policy | frame-ancestors 'self' |
ソリューション
Excluding paths
To create a list of paths excluded from this protection, use the com.atlassian.jira.clickjacking.protection.exclude
system property and separate the paths with a comma, for example:
-Dcom.atlassian.jira.clickjacking.protection.exclude=/rest/my-plugin/1.0/dashboard,/rest/collectors/1.0/template/form/
For more info, see Setting properties and options.
Determining which paths to exclude
The easiest option is to examine the access logs from Jira. For example, if you have a report in JIRA and want to display it in Confluence:
- Add an iframe with the JIRA report into Confluence and reload the page
- Confluence will attempt to make several requests to JIRA for the information needed to display the report. Due to the security headers, the report will fail to load.
- Check Jira's access logs to see what URI endpoints were requested by Confluence. These are the paths you want to exclude.
Excluding paths in plugins
JIRA 7.7, or later.
If you develop plugins for JIRA and use iframes on purpose, you can also exclude paths in a JIRA instance that uses your plugin.
Add the paths to be excluded by adding the following code to the
atlassian-plugin.xml
file.<clickjacking-http-headers-excluded-paths key=“some-unique-key-for-this-module”> <path>/plugins/servlet/reference-servlet-with-filter</path> <path>/plugins/servlet/other-servlet</path> </clickjacking-http-headers-excluded-paths>
For more info, see this Java doc.
Disabling security headers
To disable this protection, set the systemcom.atlassian.jira.clickjacking.protection.disabled
property to true
.
Steps to Disable security header
- From
<jira-install>/bin
open setenv.bat (for Windows) or setenv.sh (for Linux). - Find the section set JVM_SUPPORT_RECOMMENDED_ARGS=
- Add the following code into to the section "-Dcom.atlassian.jira.clickjacking.protection.disabled=true"
The full argument should look as follows:
set JVM_SUPPORT_RECOMMENDED_ARGS="-Dcom.atlassian.jira.clickjacking.protection.disabled=true"
- Restart JIRA to load the new argument.
For more info, see Setting properties and options.