Adding Custom HTTP Headers to an IIS Installation

Overview 

As a method of passing additional information through a server, Administrators may wish to add custom HTTP Headers to their environment. Doing so allows Administrators to add additional security parameters to their environments.

In contrast to the method of adding tags to Settings.xml (for Self Hosted environments), custom HTTP Headers can be added to an IIS installation in one of two methods:

• Editing the web.config file 
• Via IIS Manager

The following document demonstrates how to add custom HTTP Headers to IIS Decisions environments. 

Example A: IIS Manager 

To add custom HTTP Headers to an IIS Installation via IIS Manager:

1. From the Local File System, open Internet Information Services (IIS) Manager by locating it and selecting Run as administrator.
2.  Navigate to the IIS Installation via the Connections Tree on the left. Then under the IIS category, select HTTP Response Headers and click Open Feature.
3. From the HTTP Response Headers page, from the Actions menu on the right, select Add...
4. From the Add Custom HTTP Response Header window, provide a Name and desired Value for one of the Headers below, then click OK. Repeat this process for each desired Header.
   Additional Information

   Provide the following Name and Value combinations; see previous link to HTTP Headers doc for potential options for Values denoted as "[Desired Value]" below: 

   X-Frame-Options	SAMEORIGIN
   X-XSS-Protection	[Desired Value]
   X-Content-Type-Options	[Desired Value]

   

5. 
   Restart the Decisions environment.

Example B: web.config 

To add custom HTTP Headers in an IIS installation via web.config: 

1. From the Local File System, navigate to C:\Program Files\Decisions\Decisions Server. 
2. Open web.config in a Text Editor. 
3. Before the closing </configuration> tag, add the following codeblock. 
   Additional Information

   For parameters below where the Value is displayed as "VALUE", provide the desired Value. See the previously linked HTTP Headers document for more information on possible configurations. 

   <CustomHeaders> <CustomHeader> 
   <Name>X-Frame-Options</Name> 
   <Value>SAMEORIGIN</Value> 
   </CustomHeader> 
   <CustomHeader> 
   <Name>X-XSS-Protection</Name> 
   <Value>VALUE</Value> 
   </CustomHeader> 
   <CustomHeader> 
   <Name>X-Content-Type-Options</Name> <Value>VALUE</Value> </CustomHeader> </CustomHeaders>

   

4. Save and close the web.config file. 

5. Restart the Decisions environment.