Oracle WebLogic Server Recommendations to Prevent Cross-Site Scripting (XSS) Attacks
(Doc ID 2407360.1)
Last updated on JULY 24, 2023
Applies to:
Oracle WebLogic Server - Version 10.3.6 and laterInformation in this document applies to any platform.
Purpose
Some security scans may be requesting an action for these line items:
XSS Content-Security-Policy
X-XSS-Protection
These are set as http headers to take advantage of browser XSS attack prevention features. This document is provided from an Oracle Weblogic Server perspective to help application developers and administrators mitigate Cross-Site Scripting (XSS) attacks.
If using Oracle HTTP Server in front of WebLogic Server, see <Note 2370975.1>, "Oracle HTTP Server Recommendations to Prevent Cross-Site Scripting (XSS) Attacks"
This document provided the same direction, however WLS has different requirements, features and includes an Oracle built WLS Console application at /console .
Scope
Details
To view full details, sign in with your My Oracle Support account. |
|
Don't have a My Oracle Support account? Click to get started! |
In this Document
| Purpose |
| Scope |
| Details |
| What are XSS attacks ? |
| When do they occur? |
| What happens in an XSS attack? |
| How to prevent such attacks? |
| References |