JR55289: Add support for configuring cross-origin resource sharing (CORS) headers and X-Frame-Options header with a servlet filter

APAR status

• Closed as program error.

Error description

• By default, WebSphere Commerce Version 7 does not support CORS
  and X-Frame-Options header configurations.
  

Local fix

Problem summary

• USERS AFFECTED:
  WebSphere Commerce Version 7 customers who want to support CORS
  scenarios.
  
  PROBLEM ABSTRACT:
  Add support for configuring cross-origin resource sharing (CORS)
   headers and X-Frame-Options header with a servlet filter
  
  BUSINESS IMPACT:
  Adds support for CORS scenarios and X-Frame-Options header using
   a configurable servlet filter.
  
  RECOMMENDATION:
  

Problem conclusion

• Added an HttpSecurityFilter servlet filter to support the
  configuration of CORS-related headers to be included in the HTTP
   response. In addition, the filter supports the configuration of
   the cross-site scripting (XSS) header X-Frame-Options to be
  included in the HTTP response.
  
  The CORS configuration supports the whitelisting of multiple
  domains. However, the configuration of the CORS-related headers
  applies to all whitelisted domains. The HttpSecurityFilter
  supports the CORS response headers defined in the CORS
  specification:
  
      Access-Control-Allow-Origin
      Access-Control-Allow-Credentials
      Access-Control-Expose-Headers
      Access-Control-Max-Age
      Access-Control-Allow-Methods
      Access-Control-Allow-Headers
  
  To enable CORS support, you need to extend the component
  configuration file (wc-component.xml). For more information, see
  
  http://www.ibm.com/support/knowledgecenter/SSZLC2_7.0.0/com.ibm.
  commerce.install.doc/tasks/tig_JR55289.htm.
  

Temporary fix

Comments

APAR Information

• APAR is sysrouted FROM one or more of the following:

• APAR is sysrouted TO one or more of the following:

Fix information

• Fixed component name

  WC BUS EDITION

• Fixed component ID

  5724I3800

Applicable component levels

• R700 PSY

     UP