JRaman655537 (Community Member) asked a question.
693 - Protection Mechanism Failure with Apache
One of our apache website reported with 693 - Protection Mechanism Failure flaw, we have updated following information in the .htaccess file in Apache server.
Header always append X-Frame-Options SAMEORIGIN
Header always set X-XSS-Protection "1; mode=block"
Header always set X-Content-Type-Options: nosniff
Header always set Strict-Transport-Security "max-age=31536000; includeSubDomains"
even after the chnage, dynamic scan is still reporting as an issue, is there anything else we need to do?
.png){kind=logo}
Hi @JRaman655537 (Community Member) ,
If you click on the flaw in the Triage Flaws page, the Flaw Details box will load up with further information about the finding. The second tab along is labelled "Request/Response". Here you will be able to see the response sent back to our Dynamic scanner from your application, including the HTTP headers. You will likely see that the X-Frame-Options header does not appear. If it does appear, please email support@veracode.com, including the link to your scan results and the flaw ID. I would recommend checking that the .htaccess file you have configured is used for the response from that specific "Flaw URL".
Thank you,
Duncan
Above settings helped to fix the issue with 693 - Protection Mechanism Failure with Apache, our admin team did not run the dynamic scan for sometime, that was the issue.