Clickjacking protection

Scenario:

When running a security scanner against JasperServer app, a report indicates that JasperServer is vulnerable to clickjacking. What can be done to avoid this issue?

Solution:

By default clickjacking protection is not enabled but you can enable it in applicationContext-security-web.xml, find the bean:
<bean id="webAppSecurityFilter" class="com.jaspersoft.jasperserver.api.security.WebAppSecurityFilter">

<property name="antiClickJackingEnabled" value="false"/>
<property name="antiClickJackingOption" value="SAMEORIGIN"/>

Switch the antiClickJackingEnabled to true and restart. The information about possible options is contained in the bean comments.