Setting security headers

You can optionally add a Content-Security-Policy header or other security headers on each HTTP response for increased security.

This option is only available if using Internet Site documents. Note that using a more restrictive Content-Security-Policy setting than what is listed below may limit some functionality on the Traveler server home page. It will not impact Traveler synchronization functionality.

1. Under Configuration > Web > Internet Sites, open the Internet Site for web protocol for this server.
2. Select Web Site > Create Rule and enter the following:
   • Type of rule: HTTP response headers
   • Incoming URL pattern: /traveler*
   • HTTP response codes: 200, 206
   • Expires header: Add header only if application did not
   • Expires header: Specify as number of days (your choice on the number of days)
   • Custom headers:

     Custom header 1:

     • Name: Content-Security-Policy
     • Value: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self';
     • Override: unchecked
     • Applies to: All

     Custom header 2:

     • Name: X-Content-Type-Options
     • Value: nosniff
     • Override: unchecked
     • Applies to: All
3. Select Web Site > Create Rule and enter the following:
   • Type of rule: HTTP response headers
   • Incoming URL pattern: /LotusTraveler.nsf*
   • HTTP response codes: 200, 206
   • Expires header: Add header only if application did not
   • Expires header: Specify as number of days (your choice on the number of days)
   • Custom headers:

     Custom header 1:

     • Name: Content-Security-Policy
     • Value: default-src 'none'; connect-src 'self'; img-src 'self'; script-src 'unsafe-inline' 'unsafe-eval'; script-src-elem 'self' 'unsafe-inline'; style-src 'self' 'unsafe-inline';
     • Override: unchecked
     • Applies to: All

     Custom header 2:

     • Name: X-Content-Type-Options
     • Value: nosniff
     • Override: unchecked
     • Applies to: All
4. Restart the HTTP server.