KB484848: Missing or permissive X-Frame-Options HTTP response header reported when doing a security scan for MicroStrategy Web

Description

When performing a security scan for Strategy Web, it reports that "

X-Frame-Options

Solution 

You can add

X-Frame-Options

On Strategy Web JSP

• Open the

  web.xml

  file under

  <Your Strategy Web application>/WEB-INF

  . 
• Search for the keyword "

  GlobalHeaders

  " and then add the header "

  X-Frame-Options

  " to the

  <param-value>

  tag. For example: 
  

• Restart the web application server and

  X-Frame-Options

  can be found in the HTTP response header when using Strategy Web.
  

On Strategy Web ASP

• Find the Strategy Web application in IIS.
• Go to HTTP Response Headers.
  

• Add X-Frame-Options to the HTTP Response Headers.
  

• Restart IIS after making the change.

You can also refer to this Microsoft documentation to add the customer header.