How to add the HTTP X-Frame-Options header to a NuGenesis web server - WKB204013

OBJECTIVE or GOAL

Add the "X-Frame-Options" HTTP response header to the to websites/applications in Microsoft IIS. This header instructs compatible web browsers on whether a page can be loaded in a frame element.

ENVIRONMENT

• Windows Server 2019/2016/2012
• IIS has one or more websites
• NuGenesis 9
• NuGenesis 8

PROCEDURE

1. Open IIS Manager on the web server.
2. Connect to the local server.
3. Expand the Sites tree, double-click Default Web Site, and select one of the applications.
4. Double-click HTTP Response Codes.
5. Click Add.
6. Specify the following for the header name:
   • X-Frame-Options
7. Specify the following for the header value:
   • sameorigin
8. Click OK.
9. Restart the web server.

ADDITIONAL INFORMATION

This header should be added to the following sites/applications:

• NuGenesis:
  • Default Web Site (v8.0+)
  • SampleShare (v8.0+)
  • SampleShareService (v8.0+)
  • WATERSLMS (v8.0+)
  • AuditTrailClientApp (v9.1+)
  • AuditTrailWebServer (v9.1+)
  • SdmsIdentity (v9.3+)
  • SdmsProjects (v9.3+)
  • SdmsProjectServers (v9.3+)
  • SdmsSdkGateway (v9.3+)
  • SdmsUserPreferences (v9.3+)
  • SdmsVision (v9.3+)

This header is present and set to "sameorigin" by default in the Default Web Site for NuGenesis SDMS web servers.  SDMS WebVision, HelpDesk, and the legacy Audit Trail Viewer all use HTML frams, and therefore will not work if this header is set to "deny".

See article 202467 for guidance on determining whether the header is present in the HTTP replies from the server.

X-Frame-Options - HTTP | MDN (mozilla.org)