Setting GeoServer x-frame-options?

Question

I'm trying to use an i-frame to show the attributes from a Geoserver WFS layer. The Geoserver is hosted on example.com:8080/geoserver, and the page that is trying to access it (and server the i-frame) is on example.com. Now, I'd assume that this would be SAMEORIGIN, and by default geoserver is set to SAMEORIGIN for the x-frame-options (according to The geoserver user guide) So, I guess my options are to switch to ALLOW-FROM example.com, or disable xframe options.

In the manual it says you can set a web.xml init parameter but doesn't really say how.

Can anyone help me with this?

Answer 1

This is easy to fix by following the suggestions in the GeoServer docs.

You need to set either the geoserver.xframe.shouldSetPolicy variable to false to turn off X-Frame denial or geoserver.xframe.policy to "ALLOW-FROM [uri]" where uri is the location of your iFrame.

1. add it to the web.xml file:

   <context-param>
   <param-name>geoserver.xframe.policy</param-name>
   <param-value>ALLOW-FROM http://example.com</param-value>
   </context-param>

2. add it to the CATALINA_OPTS or exec line in startup.sh or startup.bat using the -D form.

   -Dgeoserver.xframe.shouldSetPolicy=false

3. add it as a system variable (for the user running tomcat or jetty).

   export geoserver.xframe.shouldSetPolicy=false

   set geoserver.xframe.shouldSetPolicy=false

You can then easily test this is working by running a simple curl request:

First with non of the above:

curl -v http://localhost:8080/geoserver/web
*   Trying 127.0.0.1...
* TCP_NODELAY set
* Connected to localhost (127.0.0.1) port 8080 (#0)
> GET /geoserver/web HTTP/1.1
> Host: localhost:8080
> User-Agent: curl/7.58.0
> Accept: */*
> 
< HTTP/1.1 302 
< X-Frame-Options: SAMEORIGIN
< Set-Cookie: JSESSIONID=F844AFA320C4F711807759A2BEC96625.route1; Path=/geoserver; HttpOnly
< Location: /geoserver/web/;jsessionid=F844AFA320C4F711807759A2BEC96625.route1
< Content-Length: 0
< Date: Tue, 29 Jan 2019 11:15:49 GMT
< 
* Connection #0 to host localhost left intact

Then with the policy set:

curl -v http://localhost:8085/geoserver/web
*   Trying 127.0.0.1...
* TCP_NODELAY set
* Connected to localhost (127.0.0.1) port 8085 (#0)
> GET /geoserver/web HTTP/1.1
> Host: localhost:8085
> User-Agent: curl/7.58.0
> Accept: */*
> 
< HTTP/1.1 302 Found
< X-Frame-Options: ALLOW-FROM http://example.com
< Set-Cookie: JSESSIONID=node010koqik22omjt1b1wbqewjrmcl0.node0;Path=/geoserver
< Expires: Thu, 01 Jan 1970 00:00:00 GMT
< Location: http://localhost:8085/geoserver/web/;jsessionid=node010koqik22omjt1b1wbqewjrmcl0.node0
< Content-Length: 0
< Server: Jetty(9.4.12.v20180830)
< 
* Connection #0 to host localhost left intact

and finally with the XFrame turned off:

curl -v http://localhost:8085/geoserver/web
*   Trying 127.0.0.1...
* TCP_NODELAY set
* Connected to localhost (127.0.0.1) port 8085 (#0)
> GET /geoserver/web HTTP/1.1
> Host: localhost:8085
> User-Agent: curl/7.58.0
> Accept: */*
> 
< HTTP/1.1 302 Found
< Set-Cookie: JSESSIONID=node01pdyu4npf3xt6130w8gehjai7t0.node0;Path=/geoserver
< Expires: Thu, 01 Jan 1970 00:00:00 GMT
< Location: http://localhost:8085/geoserver/web/;jsessionid=node01pdyu4npf3xt6130w8gehjai7t0.node0
< Content-Length: 0
< Server: Jetty(9.4.12.v20180830)
< 
* Connection #0 to host localhost left intact

Answer 2

go to location -> in geoserver of the instance i.e, /var/www/html/geoserver 2.3.x/webapps/geoserver/WEB-INF/web.xml

<filter>
<filter-name>xFrameOptionsFilter</filter-name>
<filter-class>org.geoserver.filters.XFrameOptionsFilter</filter-class>
</filter>

Replace this with :

<filter>
<filter-name>xFrameOptionsFilter</filter-name>
<filter-class>ALLOW-FROM http://localhost:8080/geoserver, 
http://example.com/* </filter-class>
</filter>

The above code will remove the X-frame options in the response Header.You can check in Inspect element.

Answer 3

In order to prevent clickjacking attacks GeoServer defaults to setting the X-Frame-Options HTTP header to SAMEORIGIN. This prevents GeoServer from being embedded into an iFrame, which prevents certain kinds of security vulnerabilities. Check from google OWASP Clickjacking entry for details.

If you wish to change this behaviour you can do so through the following properties:

• geoserver.xframe.shouldSetPolicy: controls whether the X-Frame-Options filter should be set at all. Default is true.
• geoserver.xframe.policy: controls what the set the X-Frame-Options header to. Default is SAMEORIGIN valid options are DENY, SAMEORIGIN and ALLOW-FROM [uri]

These properties can be set either via Java system property, command line argument (-D), environment variable or web.xml(\webapps\geoserver\WEB-INF init\web.xml) parameter.

After changing these settings, just save the web.xml and restart the GeoServer.

Answer 4

You can set the property geoserver.xframe.policy in the start script of geoserver. If geoserver is installed in Windows add the following line at the top of startup.bat file to allow access from example.com:

set geoserver.xframe.policy=ALLOW-FROM http://example.com

To disable xframe options completely (which will allow access from anywhere), add the following line:

set geoserver.xframe.shouldSetPolicy=false

In Linux/Unix it will be an export instead of set. E.g.:

export geoserver.xframe.policy="ALLOW-FROM http://example.com"

I tried doing this through web.xml with no success. I added the following in web.xml, but it did not work:

<filter>
  <filter-name>xFrameOptionsFilter</filter-name>
  <filter-class>org.geoserver.filters.XFrameOptionsFilter</filter-class>
  <init-param>
     <param-name>geoserver.xframe.policy</param-name>
     <param-value>ALLOW-FROM http://example.com</param-value>
 </init-param>
</filter>

Looking at getProperty function in GeoServerExtensions.java of geoserver, I felt this could be a bug in geoserver and setting the property with -D option also will not work.