# FM Server and HTTP Security Headers \[x-post\]
**URL:** https://the.fmsoup.org/t/fm-server-and-http-security-headers-x-post/2897
**Category:** Questions
**Tags:** webdirect, security, filemaker-server
**Created:** [May 10, 2022, 5:47pm UTC](https://the.fmsoup.org/t/fm-server-and-http-security-headers-x-post/2897 "2022-05-10T17:47:36Z")
**Posts on this page:** 5
**Page:** 1
### Author:  [@bowdendata](https://the.fmsoup.org/u/bowdendata)
#### Post date: [May 10, 2022, 5:47pm UTC](https://the.fmsoup.org/t/fm-server-and-http-security-headers-x-post/2897/1 "2022-05-10T17:47:36Z")
Hi all,
We have our FM Server setup for WebDirect and as part of a 3rd party vulnerability test, our site got dinged for not having several HTTP Security Headers configured.
I am not sure what tools the 3rd party is using, but they provided a Mozilla testing link for guidance. You can run this against your domain where WebDirect is running.
> **[Mozilla Observatory](https://observatory.mozilla.org/)**
>
> The Mozilla Observatory is a project designed to help developers, system administrators, and security professionals configure their sites safely and securely.
The specific items in our report are: content-security-policy, cache-control, x-content-type-options, referrer-policy, feature-policy
We set up the following headers from the Claris Engineering blog page. 1 is in our ding list and 2 that are not. We went ahead and added the 2 others.
[https://support.claris.com/s/answerview?anum=000035873&language=en\_US](https://support.claris.com/s/answerview?anum=000035873&language=en_US)
[Name] [Value]
[Strict-Transport-Security: max-age=31536000] [includeSubDomains]
[X-Content-Type-Options] [nosniff]
[X-XSS-Protection: 1] [mode=block]
From the ding list, we also added these without any apparent adverse effects. We used suggested default values from the Mozilla documentation.
[cache-control] [s-maxage=86400]
[referrer-policy] [no-referrer]
[feature-policy] [none]
That leaves us with this 1 response header. Using the suggested default from Mozilla as shown below, It causes the WebDirect home page to not show our databases. The page is blank.
[content-security-policy] [default-src https:]
Does anyone have any suggestions or experience with this security header in particular, but also any comments about the others on our ding list that were not mentioned in the Claris engineering blog?
Thanks,
Doug
---
### Author:  [@planteg](https://the.fmsoup.org/u/planteg)
#### Post date: [May 10, 2022, 6:59pm UTC](https://the.fmsoup.org/t/fm-server-and-http-security-headers-x-post/2897/2 "2022-05-10T18:59:15Z")
> [@bowdendata](#):
>
> [content-security-policy] [default-src https:]
Oh the joy of Web: many documentation found but made for those who already know the answers 😞.
According to [CSP: default-src - HTTP | MDN (mozilla.org)](https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy/default-src)
https: by itself is not a valid value for default-src. If you look at [Content Security Policy (CSP) - HTTP | MDN (mozilla.org)](https://developer.mozilla.org/en-US/docs/Web/HTTP/CSP)
(example code)
```auto
```
and
`Content-Security-Policy: default-src https://onlinebanking.jumbobank.com`
Hope that helps
---
### Author:  [@bowdendata](https://the.fmsoup.org/u/bowdendata)
#### Post date: [May 10, 2022, 8:20pm UTC](https://the.fmsoup.org/t/fm-server-and-http-security-headers-x-post/2897/3 "2022-05-10T20:20:19Z")
Hi,
We are setting the headers in in the config of the IIS server. FMS is running on Windows Server 2019. According to the documentation on this page;
> **[Content-Security-Policy - HTTP | MDN](https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy)**
>
> The HTTP Content-Security-Policy response header allows
> web site administrators to control resources the user agent is allowed to load for a
> given page. With a few exceptions, policies mostly involve specifying server origins and
> script...
using “Content-Security-Policy: default-src https:” is a valid option.
As you mentioned, the web stuff can be convoluted for sure.
Thanks,
Doug
---
### Author:  [@planteg](https://the.fmsoup.org/u/planteg)
#### Post date: [May 10, 2022, 9:04pm UTC](https://the.fmsoup.org/t/fm-server-and-http-security-headers-x-post/2897/4 "2022-05-10T21:04:12Z")
The complete page in the browser is blank, no message at all ?
What do you get if you look a the source for the page ?
Anything in FMS logs or IIE logs ?
@Malcolm do you have any idea about what's going on ? Thanks
---
### Author:  [@Malcolm](https://the.fmsoup.org/u/Malcolm)
#### Post date: [May 11, 2022, 2:47am UTC](https://the.fmsoup.org/t/fm-server-and-http-security-headers-x-post/2897/5 "2022-05-11T02:47:06Z")
@bowdendata have you tried
[content-security-policy] [default-src 'self' https:]
or do you not care where the content is coming from, so long as it has an SSL cert it is OK.