Enable/disable request URL match.

• enable — Responses to the request will be processed with the security headers only if the URL of a request matches the specified request URL.

• disable — All responses will be processed with the selected security header(s).

The request-url option is available if request-status is enabled.

Specify the URL used to match requests so that security headers can be applied to responses of the matched requests.

Specify header operation mode for the response from the back-end server(s).

• add-always — always add the specified header(s).

• add-replace —add the specified header(s) if not exist, replace the value of header(s) which exist already.

• add-if-absent — only add the specified header(s) if not exist, do nothing if the same header(s) exist

http-header-security-list

Set the HTTP security header name

The directive for the specified header in name.

X content type options: nosniff

X frame options: deny, sameorigin

X XSS protection: sanitizing-mode, block-mode

Only valid if Content-Security-Policy is selected. Enter the header value(s) that setting restrictions on resource types and sources. For example, default-src 'self';script-src 'self';object-src 'self'.

Enabling report-only switches to “Content-Security-Policy-Report-Only” header, which accepts all directives of CSP. However, “report-only” header only monitors the violations. FortiADC will check the existing of “report-uri” directive once “report-only” selected.

The time, in seconds, that the browser should remember that a site is only to be accessed using HTTPS. A max-age value of zero (i.e., “max-age=0”) signals the UA cease regarding the host as a Known HSTS Host, including the includeSubDomains directive (if asserted for that HSTS Host).

Optional. If enabled, rule will apply to all of the site's subdomains as well.

A content security policy (CSP), is an additional layer of security delivered via an HTTP header. This policy helps prevent attacks such as Cross Site Scripting (XSS) and other code injection attacks by defining content sources which are approved thus allowing the browser to load them. Without a CSP, the browser simply loads all files on a page without considering the source which could be harmful. This puts both the site and it’s visitors at risk of malicious activity.

There are multiple directives available to website owners who want to implement a content security policy. A server may also define multiple directives within a CSP security header.

For a detailed list of examples and references, visit content-security-policy.com. Additionally, you can use a tool called cspisawesome.com to easily create a CSP specific to your needs.

FortiADC also provides a “report-only” flag to switch to “Content-Security-Policy-Report-Only” header, which accepts all directives of CSP, but the difference is that “report-only” header only monitor the violations. FortiADC will check the existing of “report-uri” directive once “report-only” selected.

The X-Content-Type-Options response HTTP header is a marker used by the server to indicate that the MIME types advertised in the Content-Type headers should not be changed and be followed. This helps reduce the danger of drive-by downloads and helps treat the content the proper way.

There is only one directive that can be used, which is nosniff. An example of the header looks like:

x-content-type-options: nosniff

The x-frame-options header provides clickjacking protection by not allowing iframes to load on your website. It is supported by IE 8+, Chrome 4.1+, Firefox 3.6.9+, Opera 10.5+, Safari 4+.

There are three directives available for this header: deny, sameorigin and allow-from. But “allow-from” is obsolete and no longer works in modern browers, FortiADC will notsupport it.

On FortiADC, there are two directive options: deny and sameorigin.

Once “deny” selected, the header looks like:

x-frame-options: DENY

Once “sameorigin” selected, the header looks like:

x-frame-options: SAMEORIGIN

The x-xss-protection header is designed to enable the cross-site scripting (XSS) filter built into modern web browsers. This is usually enabled by default, but using it will enforce it.

Although these protections are largely unnecessary in modern browsers when sites implement a strong Content-Security-Policy that disables the use of inline JavaScript ('unsafe-inline'), they can still provide protections for users of older web browsers that don't yet support CSP.

On FortiADC, this function has two modes to be choose: sanitizing-mode and block-mode. Once sanitizing-mode selected (usually default in browsers), an example looks like:

x-xss-protection: 1

Once block-mode selected, an example looks like:

x-xss-protection: 1; mode=block