How to exclude ServletFilter URLs from Confluence’s default security headers

Starting from version 9.0, Confluence adds default security headers to improve security. There may be some cases where you wish to prevent Confluence from adding these default security headers to some URLs. In this case, add init-param: securityHeadersExcluded to the servlet-filter module.

Confluence adds the following default security headers to a response:

• X-XSS-Protection: 1; mode=block
• X-Content-Type-Options: nosniff
• X-Frame-Options: SAMEORIGIN
• Content-Security-Policy: frame-ancestors 'self' with the URLs of configured application links or policies defined in the http.header.security.content.security.policy.value system property.

1
2
package com.atlassian.confluence.plugin.example.optoutsecurityheaders;

import javax.servlet.FilterChain;
import javax.servlet.GenericFilter;
import javax.servlet.ServletException;
import javax.servlet.ServletRequest;
import javax.servlet.ServletResponse;
import java.io.IOException;

public class OptOutSecurityHeadersFilter extends GenericFilter {
    public void doFilter(ServletRequest request, ServletResponse response, FilterChain chain) throws IOException, ServletException {
        chain.doFilter(request, response);
    }

    @Override
    public void destroy() {

    }
}

Confluence will not add any default security headers to the URLs matched by your servlet filter if you add the parameter init-param with the name securityHeadersExcluded and a value of true.

1
2
<atlassian-plugin key="optOutSecurityHeadersExample" name="Opt Out Security Headers Examples" plugins-version="2">
    <plugin-info>
        <description>${project.description}</description>
        <version>${project.version}</version>
        <vendor name="${project.organization.name}" url="${project.organization.url}" />
    </plugin-info>

    <servlet-filter name="Opt Out Security Headers Filter" key="optOutSecurityHeadersFilter" 
        class="com.atlassian.confluence.plugin.example.optoutsecurityheaders.OptOutSecurityHeadersFilter" weight="1">
        <description>Filter whose matched urls will be opted out from adding default security headers</description>
        <url-pattern>/some-paths-to-opt-out</url-pattern>
        <init-param>
            <param-name>securityHeadersExcluded</param-name>
            <param-value>true</param-value>
        </init-param>
    </servlet-filter>
</atlassian-plugin>