IT33780: WEBUI X-FRAME-OPTIONS HEADER CANNOT BE CHANGED FROM SAMEORIGIN

APAR status

• Closed as program error.

Error description

• The IIB v10 and ACE v11 administration web user interfaces send
  the X-Frame-Origin header with a value of "SAMEORIGIN" with
  every request to provide protection against click jacking
  attacks.
  
  This header prevents the web user interface from
  being embedded in another website. While this is generally the
  preferred default for most users, some users wish to embed the
  web user interface within their own administrative dashboards
  which requires that the X-Frame-Options header not be
  set.
  
  This APAR introduces new configuration options that allow
  the X-Frame-Options header value to be changed or to prevent
  the header from being sent at all.
  

Local fix

• N/A
  

Problem summary

• ****************************************************************
  USERS AFFECTED:
  All users IBM Integration Bus v10 and IBM App Connect Enterprise
  v11 wishing to embed web user interface in another webpage.
  
  
  Platforms affected:
  z/OS, MultiPlatform
  
  ****************************************************************
  PROBLEM DESCRIPTION:
  The IIB v10 and ACE v11 administration web user interfaces send
  the X-Frame-Origin header with a value of "SAMEORIGIN" with
  every request to provide protection against click jacking
  attacks.
  
  This header prevents the web user interface from being embedded
  in another website. While this is generally the preferred
  default for most users, some users wish to embed the web user
  interface within their own administrative dashboards which
  requires that the X-Frame-Options header not be set.
  

Problem conclusion

• A new setting has been added to v10 and v11 called
  "antiClickJackingOption".
  
  At v10 this setting is on the webadmin server component and can
  take one of the following values:
  
  * "SAMEORIGIN" - sets the X-Frame-Origin header to "SAMEORIGIN"
  * "DENY" - sets the X-Frame-Origin header to "DENY"
  * "disabled" - disables sending the X-Frame-Origin header. This
  disables anti clickjacking protection.
  
  This value can be changed by running mqsichangeproperties BROKER
  -b webadmin -o server -n antiClickJackingOption -v <VALUE>
  
  At v11 this setting is the RestAdminListener section of the
  node.conf.yaml or server.conf.yaml and can take one of the
  following values:
  
  * "SAMEORIGIN" - sets the X-Frame-Origin header to "SAMEORIGIN"
  * "DENY" - sets the X-Frame-Origin header to "DENY"
  * "" (the empty string) - disables sending the X-Frame-Origin
  header. This disables anti clickjacking protection.
  
  ---------------------------------------------------------------
  The fix is targeted for delivery in the following PTFs:
  
  Version    Maintenance Level
  v10.0      10.0.0.22
  v11.0      11.0.0.10
  
  The latest available maintenance can be obtained from:
  http://www-01.ibm.com/support/docview.wss?rs=849&uid=swg27006041
  
  If the maintenance level is not yet available,information on
  its planned availability can be found on:
  http://www-1.ibm.com/support/docview.wss?rs=849&uid=swg27006308
  ---------------------------------------------------------------
  

Temporary fix

Comments

APAR Information

• APAR is sysrouted FROM one or more of the following:

• APAR is sysrouted TO one or more of the following:

Fix information

• Fixed component name

  INTEGRATION BUS

• Fixed component ID

  5724J0540

Applicable component levels