Uploaded image for project: 'Confluence Data Center'
  1. Confluence Data Center
  2. CONFSERVER-81829

HSTS configuration not working in confluence 8.0.2

XMLWordPrintable

      Issue Summary

      This is reproducible on Data Center: Yes

      Steps to Reproduce

      1. Configure confluence on SSL
      2. Follow KB - how-to-enable-and-configure-http-strict-transport-security-hsts-response-header-on-confluence
      3. Attached web.xml with modifications

      Expected Results

      • Need to see strict transport security header, when accessing the instance

      Actual Results

      Headers not visible

      Workaround

      Currently there is no known workaround for this behavior. A workaround will be added here when available

      Important note for the fix

      Please read the updated documentation for configuring HSTS response headers.

      https://confluence.atlassian.com/confkb/how-to-enable-and-configure-http-strict-transport-security-hsts-response-header-on-confluence-1071813084.html

        1. web.xml
          173 kB

          Form Name

            [CONFSERVER-81829] HSTS configuration not working in confluence 8.0.2

            Rodolfo So added a comment -

            I noticed when the HSTS enabled in 8.2.0, Clickjacking is not working anymore. I've tried to followig these steps below for COnfluence Data Center 8,2.0 and the application always fail. I want to disable the iframe in our Confluence due to vulnerability issue. Please advise.

            Server OS: Windows

            Confluence DC: 8.2.0

            Run confluence via window service.

            https://confluence.atlassian.com/confkb/confluence-page-does-not-display-in-an-iframe-827335781.html

             

            Rodolfo So added a comment - I noticed when the HSTS enabled in 8.2.0, Clickjacking is not working anymore. I've tried to followig these steps below for COnfluence Data Center 8,2.0 and the application always fail. I want to disable the iframe in our Confluence due to vulnerability issue. Please advise. Server OS: Windows Confluence DC: 8.2.0 Run confluence via window service. https://confluence.atlassian.com/confkb/confluence-page-does-not-display-in-an-iframe-827335781.html  

            Yaroslava Derkach (Inactive) added a comment -

            A fix for this issue is available in Confluence Server and Data Center 8.2.0.
            Upgrade now or check out the Release Notes to see what other issues are resolved.

            Yaroslava Derkach (Inactive) added a comment - A fix for this issue is available in Confluence Server and Data Center 8.2.0. Upgrade now or check out the Release Notes to see what other issues are resolved.

            Richard Lau added a comment -

            A note for the above has just been added to our documentation. Thank you!

            https://confluence.atlassian.com/confkb/how-to-enable-and-configure-http-strict-transport-security-hsts-response-header-on-confluence-1071813084.html

            Richard Lau added a comment - A note for the above has just been added to our documentation. Thank you! https://confluence.atlassian.com/confkb/how-to-enable-and-configure-http-strict-transport-security-hsts-response-header-on-confluence-1071813084.html

            Michael B. Gilliam added a comment -

            A note indicating that HSTS is now enabled by default and the previous steps of enabling would actually cause the application to fail would been helpful. Once the modifications to web.xml were removed the application ran successfully with HSTS enabled. Appreciate the response and implementation.

            Michael B. Gilliam added a comment - A note indicating that HSTS is now enabled by default and the previous steps of enabling would actually cause the application to fail would been helpful. Once the modifications to web.xml were removed the application ran successfully with HSTS enabled. Appreciate the response and implementation.

            Saran Babu Pannuru (Inactive) added a comment -

            A fix for this issue is available in Confluence Server and Data Center 8.1.1.
            Upgrade now or check out the Release Notes to see what other issues are resolved.

            Saran Babu Pannuru (Inactive) added a comment - A fix for this issue is available in Confluence Server and Data Center 8.1.1. Upgrade now or check out the Release Notes to see what other issues are resolved.

              rlau@atlassian.com Richard Lau
              4b0790dbfd74 Jetendra Ivaturi (Inactive)
              Affected customers:
              2 This affects my team
              Watchers:
              8 Start watching this issue

                Created:
                Updated:
                Resolved: