HealthCheck Assistance
The Health Check has determine one of more of the recommeded Reponse Headers are not configured.
To enhance the security of Playbook and Mobile, it is recommended that the following Response Headers be configured. This can be configured at the "Default Web Site" level where it will be inherited by the application or for the specific application.
Referrer-Policy:strict-origin
With this policy, only the origin is sent in the Referer header of cross-originrequests. This prevents leaks of private data that may be accessible from other parts of the full URL such as the path and query string.
Further recommended but optional headers should be implemented:
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block
Strict-Transport-Security max-age=31536000; includeSubDomains
Cache-Control no-cache
WWW-Authenticate negotiate
NOTE: If you have any questions, please contact AP ENPS Support before making changes to the HealthCheck configurations.
This headers can be added in two ways, via the Computer Manager console or via PowerShell.
Select Start, select Administrative Tools, and then select Internet Information Services (IIS) Manager.
In the connections pane, expand the node for the server, and then expand Sites.
Select the Default Web Site to add the custom HTTP response header.
In the web site pane, double-click HTTP Response Headers in the IIS section.
In the actions pane, select Add.
In the Name box, type Referrer-Policy.
In the Value box, type strict-origin.
Select OK.
PowerShell:
Add-WebConfigurationProperty -PSPath 'MACHINE/WEBROOT/APPHOST/Default Web Site' `
-Name . -Filter 'system.webServer/httpProtocol/customHeaders' `
-AtElement @{name = "Referrer-Policy" ; value = 'strict-origin' }
For the additional headers simply substitude the names and values using the preferred method above.
No thresholds set for this monitoring.