Uploaded image for project: 'JIRA Server (including JIRA Core)'
  1. JIRA Server (including JIRA Core)
  2. JRASERVER-25143

Enable X-FRAME-Options header to implement clickjacking protection

    Details

    • Feedback Policy:

      JIRA feedback is collected from a number of different sources and is evaluated when planning the product roadmap. If you would like to know more about how JIRA Product Management uses customer input during the planning process, please see our post on Atlassian Answers.

      Description

      NOTE: This suggestion is for JIRA Server. Using JIRA Cloud? See the corresponding suggestion.

      TLDR: Add X-FRAME-Options: SAMEORIGIN to all HTTP(S) pages (server config), and test that nothing breaks.

      Description: Current HTTP headers do not contain the X-FRAME-Option, which helps prevents against Clickjacking attacks. A Clickjacking attack is similar to CSRF in which attacker can hijack a "click" on a web application from another "invisible" frame in the browser. Essentially, an attacker can force a user to click on a button that is invisible to him/her.

      Exploit Scenario: An attacker crafts a malicious page such that when their victim clicks, they are actually clicking on the link or button in the vulnerable application hosted in an iframe. Thus, an attacker tricks the user into performing an action of the attacker's choosing by directing mouse input to the target application.

      Workaround

      Applying an additional header to the Apache HTTP server can mitigate this problem. Specifically using the SAMEORIGIN setting. If the header contains the SAMEORIGIN option, the response will be loaded within a frame only if the parent page is from the same origin.

      For Apache:

      1. Add this to your httpd.conf file:
        Header always append X-Frame-Options SAMEORIGIN
        
      2. Ensure the headers module is enabled, the below is required in httpd.conf, or if using Ubuntu/Debian a2enmod headers will turn it on.
        LoadModule headers_module modules/mod_headers.so
        
      3. Restart Apache.

      Note that this is not a panacea for clickjacking. SAMEORIGIN should be safe to use and not provide any negative side-effects.

      SAMEORIGIN will prevent the Issue Collector from loading when embedded in a Confluence page

        Attachments

          Issue Links

            Activity

              People

              • Assignee:
                Unassigned
                Reporter:
                vosipov Vitaly Osipov [Atlassian]
              • Votes:
                30 Vote for this issue
                Watchers:
                59 Start watching this issue

                Dates

                • Due:
                  Created:
                  Updated: