Setting secure headers in HTTP Response

Configuring Default Headers in eStudio Profile Manager
Testing the response in Fiorano Dashboard

This feature will set security headers for the API Management Server (AMS) Jetty.

Headers:

Icon

Security headers are directives used by web applications to configure security defenses in web browsers. Based on these directives, browsers can make it harder to exploit client-side vulnerabilities such as Cross-site Scripting or Clickjacking.

HTTP headers are the name or value pairs that are displayed in the request/response messages of message headers for Hypertext Transfer Protocol (HTTP). HTTP headers are an integral part of HTTP requests and responses. In simpler terms, HTTP headers are the code that transfers data between a Web server and a client.

Setting security headers by providing custom values to the default headers enhances the security of HTTP headers.

Configuring Default Headers in eStudio Profile Manager

To set secure headers in the HTTP response, perform the following actions in eStudio after stopping the AMS:

Open the AMS profile from the Profile Management perspective.
Go to APIManager > Fiorano > APIManager > APIJetty > APIManagerJetty and provide the following value in the DefaultHeaders property:
Save the profile (CTRL+S) and start the AMS server.

Testing the response in Fiorano Dashboard

To confirm whether the settings are applied to the server configuration, perform the following actions in Fiorano Dashboard:

Login to Fiorano API Dashboard (http://localhost:1981/apimgmt).
Perform an action (like clicking the API Projects tab) that invokes a request.
Open browser developer tools (CTRL+SHIFT+I) and refresh the page or click on any tab.
In the Network tab of the browser developer tool, click the name corresponding to the request made (here, apiProjectEvents).

Icon

Response Headers values for testHeader1 and testHeader2 attributes reflect the settings in the profile manager configuration.