Skip to main content
Skip table of contents

Configuring Header Policies for the Identity Provider


Admins can increase security of the Identity Provider by setting up security defenses such as restricting headers.

Configuring Header Policies

As an admin, you can configure accepted headers by the Identity Provider:

To configure the Header Policy, perform the following steps:

  1. Navigate to the Policies page.

  2. Navigate to the Security Defenses tab.

  3. Click on the Edit Button of the Headers Settings Panel.

  4. A dialog will appear. Apply the desired changes and click on the Confirm Button.

Header Settings

The following table gives an overview of available Header Settings:




Default value prevents pages from being included by non-origin iframes.


Default value prevents pages from being included by non-origin iframes.


For testing Content Security Policies.


Default value prevents Internet Explorer and Google Chrome from MIME-sniffing a response away from the declared content-type.


Prevent pages from appearing in search engines.


This header configures the Cross-site scripting (XSS) filter in your browser. Using the default behavior, the browser will prevent rendering of the page when a XSS attack is detected.

HTTP Strict Transport Security (HSTS)

The Strict-Transport-Security HTTP header tells browsers to always use HTTPS. Once a browser sees this header, it will only visit the site over HTTPS for the time specified (1 year) at max-age, including the subdomains.

JavaScript errors detected

Please note, these errors can depend on your browser setup.

If this problem persists, please contact our support.