Protecting your web application by using a firewall

IBM Content Navigator is deployed with the ESAPI Web Application Firewall.

The ESAPI Web Application Firewall is configured as a servlet filter in front of all IBM Content Navigator web services. An XML policy file contains the rules for the firewall to enforce. These rules can range from simple virtual patching to complex authorization enforcement with BeanShell scripts. The policy file for the firewall is stored in the IBM Content Navigator web application.

The file name of the policy file is install_dir/WEB-INF/ESAPIWafPolicy.xml.default. For releases earlier than V3.0.8, the file name of the policy file is install_dir/WEB-INF/ESAPIWafPolicy.xml.

To protect the web application from known security vulnerabilities, you can modify the policy file to add rules and block services. For more information about the structure of the policy file, the individual rules and how they work, and examples, see Web Application Firewall Policy File Specification.

Important: The default policy does not allow loading external resources unless HTTPS is used. It also does not allow IBM Content Navigator to be embedded in external hosts even when HTTPS is used which will prevent the IBM Content Navigator Web Parts from being loaded. For information about using a custom policy file to remove these restrictions, see How to configure the Content Security Policy header in IBM Content Navigator.

Restriction: The rule types detect-content and dynamic-insertion are not supported by IBM Content Navigator.
You can specify the web application firewall to use the default or a custom policy file by using one of the following methods:
Using the IBM Content Navigator Configuration and Deployment tool
  1. Open the profile using the IBM Content Navigator Configuration and Deployment tool.
  2. Select the Configure the IBM Content Navigator Web Application and edit the task.
  3. For the Web application firewall policy option, specify Default or Custom. If you specify Custom, you must enter the path for the web application firewall policy file.
  4. Save your changes.
Important: If you use the IBM Content Navigator user interface to update the policy on an existing system, the schema name field will become blank. You can click the blank field (and enter the schema name) to repopulate the value.
Using the command-line interface
For detailed instructions see How to add the Web application fire wall policy option in the configurateicntask.xml file