--- title: "Web Security Configuration" slug: "web-security-configuration" description: "How to Configure Web Security in RapidIdentity beyond the default security settings." updated: 2024-02-21T22:30:44Z published: 2024-02-21T22:30:44Z canonical: "help.rapididentity.com/web-security-configuration" --- > ## Documentation Index > Fetch the complete documentation index at: https://help.rapididentity.com/llms.txt > Use this file to discover all available pages before exploring further. # Web Security Configuration ## Web Security Configuration in RapidIdentity Web Security Configuration options instruct RapidIdentity to include various HTTP Response Headers such as X-Frame-Options, Content-Security-Policy and Strict-Transport-Security to prevent browser-based vulnerabilities and protect against malicious attacks. To configure the Web Security Configuration in RapidIdentity, as a Tenant or System Administrator, navigate to Configuration > General > Settings > Web Security NOTE:Some HTTP response headers can be present in the response more than one time and some are not supposed to. With specific regards to RapidIdentity, the `X-Frame-Options` and `Strict-Transport-Security` headers are single-valued while the `Content-Security-Policy` header can support multiple values. ### XFrame Options **X-Frame Options** can be used to indicate whether a browser should be allowed to embed the web page in another page. These options can be used to avoid click-jacking attacks by ensuring that their content is not embedded into other sites. For each rule, define a Path Regex (Path Regular Expression) and provide it with a Value. Every HTTP request that comes into RapidIdentity will be evaluated against the list in order. When a match is found, then the server's response will contain the *X-Frame-Options* header value defined for that path. The default RapidIdentity settings define XFrame Options Header Rules for the Claim My Account, Forgot My Password, and Expired Password functionalities. Others may be added if desired. *RapidIdentity evaluates these rules in order from top to bottom. To reorder rules, click the stack icon on the right of the rule and drag it up or down within the list.* ![](https://cdn.document360.io/4d958006-b877-42af-8de5-00e3bb7fe41d/Images/Documentation/image-1708549279543.png) **Path Regex** is a Java regular expression meant to match against a particular HTTP request URI path made against the server. For instance, a value of "/portal/." will match all requests to "/portal/" and requests to sub paths of "/portal/". A pathRegex value of "." will match ALL HTTP requests to the RapidIdentity server. **Value** is a choice of three options to define what the browser does with the content found through the Path Regex. Options are as follows: - SAMEORIGIN: The page will be displayed in a frame on the same origin as the page itself. - DENY: The page will not be displayed in a frame. - ALLOW-FROM : The page will be displayed in a frame on the specified origin. Example: allow-from https://www.example.com. *For more information on XFrame Options visit* [*https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-Frame-Options*](https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-Frame-Options) ### Content Security Policy **Content Security Polic****y** **(**[**CSP**](https://developer.mozilla.org/en-US/docs/Glossary/CSP)[](https://developer.mozilla.org/en-US/docs/Glossary/CSP)**[](https://developer.mozilla.org/en-US/docs/Glossary/CSP)****)** helps to detect and mitigate certain types of attacks, including Cross-Site Scripting ([XSS](https://developer.mozilla.org/en-US/docs/Glossary/Cross-site_scripting)) and data injection attacks. These attacks are used for everything from data theft to site defacement, to malware distribution. For each rule, define a Path Regex (Path Regular Expression) and provide it with one or more Values. (This is the only header option that accepts multiple values.) Every HTTP request that comes into RapidIdentity will be evaluated against the list in order. When a match is found, the server's response will contain the Content-Security-Policy header values defined for that path. RapidIdentity ships with some defaults already set for base functionality. The default RapidIdentity settings define Content Security Policy Header Rules for the Claim My Account, Forgot My Password, and Expired Password functionalities. Others may be added as desired. New values may also be added to existing rules by clicking Add within the rule box and adding a new value for that rule. *RapidIdentity evaluates these rules in order from top to bottom. To reorder rules, click the stack icon on the right of the rule and drag it up or down within the list.* ![](https://cdn.document360.io/4d958006-b877-42af-8de5-00e3bb7fe41d/Images/Documentation/image-1708549892220.png) **Path Regex** is a Java regular expression meant to match against a particular HTTP request URI path made against the server. For instance, a value of "/portal/." will match all requests to "/portal/" and requests to sub paths of "/portal/". A pathRegex value of "." will match ALL HTTP requests to the RapidIdentity server. **Value** is a choice of options to define the source for the determined policy. This can be one of the following: - **:** Internet hosts by name or IP address. May include a URL scheme and/or port number if desired. Asterisks may be used as wild cards for leading URLs or defining ports. Examples of this source include http://*.example.com, mail.example.com:443, https://store.example.com, etc. - **:** A scheme such as http: or https:. The colon is required, and the scheme should not be quoted. Data schemes can be specified, but this is not recommended. - **'self':** This refers to the origin from which the protected content is being served, which includes the URL scheme and port number. Single quotes must be included. *For more information on Content Security Policy (CSP) visit* [*https://developer.mozilla.org/en-US/docs/Web/HTTP/CSP*](https://developer.mozilla.org/en-US/docs/Web/HTTP/CSP) ### Strict Transport Security **S****trict Transport Security** informs browsers that the site should only be accessed using HTTPS, and that any future attempts to access it using HTTP should automatically be converted to HTTPS. The default RapidIdentity settings do not define any Strict Transport Security Header Rules, allowing browsers to access each portion of the domain via HTTP. To modify the existing rule or add a new one, click the Header Enabled checkbox at the top of the menu and provide a value for the existing rule or add a new rule. *RapidIdentity evaluates these rules in order from top to bottom. To reorder rules, click the stack icon on the right of the rule and drag it up or down within the list.* ![](https://cdn.document360.io/4d958006-b877-42af-8de5-00e3bb7fe41d/Images/Documentation/image-1708550232678.png) For each rule, define a **Path Regex** (Path Regular Expression) and provide it with a **Value**. Every HTTP request that comes into RapidIdentity will be evaluated against the list in order. When a match is found, the server's response will contain the Strict-Transport-Security header value defined for that path. **Path Regex** is a Java regular expression meant to match against a particular HTTP request URI path made against the server. For instance, a value of "/portal/." will match all requests to "/portal/" and requests to sub paths of "/portal/". A pathRegex value of "." will match ALL HTTP requests to the RapidIdentity server. **Value** is a choice of directives to provide the browser with instructions regarding the content found through the Path Regex. Directives include: - **max-age=:** Defines the number of seconds that the browser should remember to only access the site via HTTPS. - **includeSubDomains:** An optional parameter that applies to all of the site's subdomains as well. - **preload:** An optional parameter that includes certification through various browsers' HTTP Strict Transport Security (HSTS) Preload Lists. *For more information on Strict Transport Security (HSTS) visit [https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Strict-Transport-Security](https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Strict-Transport-Security)* ### Referrer Policy The **Referrer Policy** controls the information to be sent with the Referer header. *RapidIdentity evaluates these rules in order from top to bottom. To reorder rules, click the stack icon on the right of the rule and drag it up or down within the list.* ![](https://cdn.document360.io/4d958006-b877-42af-8de5-00e3bb7fe41d/Images/Documentation/image-1708550451084.png) **Path Regex** is a Java regular expression meant to match against a particular HTTP request URI path made against the server. For instance, a value of "/portal/." will match all requests to "/portal/" and requests to sub paths of "/portal/". A pathRegex value of "." will match ALL HTTP requests to the RapidIdentity server. **Value** is a choice of directives to provide the browser with instructions regarding the information to be included with requests to the Path Regex. Directives include: - **no-referrer:** The Referer header will be omitted, sent requests do not include any referrer information. - **no-referrer-when-downgrade:** Send the origin, path, and querystring in Referer when the protocol security level stays the same or improves (HTTP→HTTP, HTTP→HTTPS, HTTPS→HTTPS) but don't send the Referer header for requests to less secure destinations (HTTPS→HTTP, HTTPS→file) - **origin:** Send only the origin in the Referer header ie: a document at https://example.com/page.html will send the referrer https://example.com/ - **origin-when-cross-origin:** When performing a same-origin request to the same protocol level (HTTP→HTTP, HTTPS→HTTPS), send the origin, path, and query string but send only the origin for cross origin requests and requests to less secure destinations (HTTPS→HTTP) - **same-origin:** Send the origin, path, and query string for same-origin requests. Don't send the Referer header for cross-origin requests - **strict-origin:** Send only the origin when the protocol security level stays the same (HTTPS→HTTPS) but don't send the [`Referer`](https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Referer) header to less secure destinations (HTTPS→HTTP) - **strict-origin-when-cross-origin:** Send the origin, path, and querystring when performing a same-origin request; for cross-origin requests send the origin (only) when the protocol security level stays same (HTTPS→HTTPS) but don't send the Referer header to less secure destinations (HTTPS→HTTP) - **unsafe-url:** Send the origin, path, and query string when performing any request, regardless of security *For more information on the Referrer Policy visit* [*https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Referrer-Policy*](https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Referrer-Policy) ### Permissions Policy The **Permissions Policy** is a mechanism used to allow and deny the use of browser features in a document or within any *