Configuring Web Security Settings

Configuring your archive's web security settings

The Web Security Settings section allows Administrators to configure settings that prevent malicious execution of code either on Cryoserver itself, or on the end user PC via the Cryoserver Web.

1. Navigate to Adv Configuration > Web Security Settings.

2. Enter / Select the required values in the fields. Refer to the table below for field names and descriptions.

3. Click "Save"

Note: Please hover over the on-screen information for additional information about field names and related areas.

Field	Description
Referrer Validation Level	Validation level for links coming from referrer sites.
Allowed Referrer Hosts	List of hostnames / host addresses from which URL links to Cryoserver web will be allowed. This field plays two key roles: - Intranet links to Cryoserver: To prevent websites that you are not aware of from linking to this Cryoserver system. In theory, a malicious third party web site may try to mask the Cryoserver web behind its own UI. Therefore, for your internal intranet web or any other portals that you know about that link to the Cryoserver web you will need to add their hostname to the referrer list here. Without this your users will see an “Unknown Referrer – access denied” message – showing the referrer hostname that is not known to Cryoserver. - Stubbing URL Links when security is enabled (transport agent / OWA Plugin): Stubbing services will convert attachments in Exchange Emails to URL links. These URL links will open the attachment from Cryoserver. If Stubbing URL Security is enabled then every time a Stub URL link is followed, Cryoserver will try to obtain the users username to see if they are valid to view the attachment [a sender or recipient of the email containing the attachment]. However, to allow the “Transport Agent” and the “OWA Plug-in” will also follow these URL links. However they will need to bypass the security check. So enter the server name / IP address on which the Transport Agent and OWA Plug-In are installed.
Malicious web parameter handling	Action that should be taken to handle malicious web parameter.
Filter web parameters with AntiSamy	Specifies whether or not the feature of filtering web parameters with AntiSamy is turned On.
Display HTML editor controls	Specifies whether HTML editor controls are shown or hidden to the users.
Ensure HttpOnly cookie	Specifies whether or not HttpOnly cookie should be used to prevent illegitimate access.
Force a login check for stubbing URL Links	Specifies whether or not users are checked and must be a sender or recipient of the email that contains the attachment.
Protection against framing attacks	Specifies whether or not other websites should be prevented from framing pages of Cryoserver web application.
Discard web requests containing unsafe characters in ‘referer’ header	Specifies whether or not referer headers, in web requests, are checked, for potentially unsafe value.