QlikView WebServer: Custom HTTP Header

[ToniKautto]

The QlikView WebServer (QVWS) supports custom HTTP response headers as of release 12.30. 

Custom response headers are defined in QVWS config.xml file.

Note that for QlikView deployments using IIS as a web server, custom HTTP headers must be configured in IIS. 

An example use case for this is the introduction of HTTP headers preventing any possible ClickJacking vulnerabilities. This type of attack is mitigated by adding an X-Frame-Options HTTP response header, which can be used to indicate whether or not a browser should be allowed to render a page in a <frame>, <iframe> or <object>. Sites can use this to avoid clickjacking attacks, by ensuring that their content is not embedded into other sites. For more information on X-Frame-Options, see, for example, X-Frame-Options (Mozilla).

Environment:

QlikView (12.30 and later)

Resolution:

Configure Custom Headers 

1. Run text editor (e.g. Notepad) as Administrator 
2. Edit QlikView WebServer configurations file. Default path; C:\ProgramData\QlikTech\WebServer\config.xml
3. Locate CustomHeaders element within the config file
4. Replace empty element <CustomHeaders /> with open and closed elements <CustomHeaders></CustomHeaders> if needed. 

   <Config>
     ...
     <Web>
       <CustomHeaders>
       ...
       </CustomHeaders>
     </Web>
   </Config>

5.  Add custom response header as <Header> element(s) with sub-elements defining the desired header name and value. 

   <Config>
     ...
     <Web>
       ...
       <CustomHeaders>
         <Header>    
           <Name>Header1</Name>
           <Value>Value1</Value>
         </Header>
         <Header>    
           <Name>Header2</Name>
           <Value>Value2</Value>
          </Header>
       </CustomHeaders>
     </Web>
   </Config>
   

6. Restart QlikView WebServer service

Validate custom headers

7. Open browser
8. Enable browser developer tools
9. Open QlikView AccessPoint
10. Validate in HTTP response header that custom header has been set