14 Security Properties

The following topics provide information about each property associated with the Security category in the wcs_properties.json file:

14.1 About the Properties in the Security Category

Properties in the Security category determine how security is configured on both the management and the delivery systems. Before developers design the online site or make changes to the user interface on the management system, you must implement your security protocols using the Security properties in the WebCenter Sites wcs_properties.json file.

Additionally, Security properties with the sub category Content Security allow you to configure content security protection for websites developed through WebCenter Sites. Content Security is a standard which enables you to determine whether pages returned by the browser can be embedded inside an iframe of some other website. For detailed information about Content Security, see the specification documentation about the Content Security Policy.

14.2 Properties in the Security Category

Table 14-1 provides a description for each of the properties in the JSON file associated with the Security category.

Table 14-1 Security Properties

Property	Description
`connect-src`	List of URIs the protected resource can load using script interfaces. Subcategory: Content Security
`contentsecurity.enabled`	Set the value to `true` to enable Content Security protection. Default value: `false` Subcategory: Content Security
`cs.selfmodify`	Specifies a comma-separated list of attributes that a user is allowed to modify. Currently, only `password` is supported. For complete backward compatibility, set the property to blank to ensure that the user has write privileges to the `SystemUsers` table. Default value: `password`
`default-src`	Comma-separated source list of default directives. For example: `child-src,connect-src,img-src,object-src,script-src,style-src`. Subcategory: Content Security
`frame-ancestors`	Allowed hosts for embedding protected resource in iframes. Possible values: `self blank`: the pages from the current site can be embedded either by an ancestor frame that has the `src` attribute as `about:blank` or the current site itself. `about:blank`: Required for WebCentrer Sites to work because pages are made of frames that have `#about:blank` as `src`. Subcategory: Content Security
`ft.suppressPasswordNames`	Specifies variable names that are used as passwords and should be suppressed when ft.suppressPasswords is set to `true`. The Cheetah installer now sets this property to: `REMOTEPASS;pubtgt:factors;factors` to suppress its mirror publish target passwords in the log. Default value: `REMOTEPASS;pubtgt:factors;factors`
`ft.suppressPasswords`	Prevents any input or session variables containing the strings "`password`" or "`PASSWORD`" in their names from being logged. Default value: `true` Specify `false` to include passwords in the log.
`img-src`	Restricts from where the protected resource can load images. Subcategory: Content Security
`object-src`	Restricts from where the protected resource can load plugins. Possible values: `self` `blank` Subcategory: Content Security
`script-src`	Restricts which scripts the protected resource can execute. Subcategory: Content Security
`wcsites.encodeTemplateParams`	Contains a Boolean value that enables encoding of default template parameters, such as `c`, `cid`, `pagename`, and so on. Possible values: `true:` Enable encoding of template parameters. `false:` Disable encoding of template parameters. Default value: `true`
`xcelelem.manageuserpub`	Defines the element used for managing the roles that users fulfill on sites in WebCenter Sites. Default value: `OpenMarket/Xcelerate/Actions/Security/AccessUserPublication`
`xcelerate.authorizefunctions`	Contains a comma-separated list of functions for which permissions can be generated on an asset. If the value is empty, all possible functions will be displayed. Additional system-defined functions can be added to the list of default functions. Default value: `inspect,checkout,copy,edit,delete,rollback,approve`
`xcelerate.deny.abstainfromvoting`	Contains a comma-separated list of roles that are not allowed to abstain from voting when assigned assets as part of the workflow process. Default value: blank
`xcelerate.deny.approve`	Contains a comma-separated list of roles that are not allowed to approve assets for publishing. Default value: blank
`xcelerate.deny.authorize`	Contains a comma-separated list of roles that are not allowed to authorize privileges on assets. Default value: blank
`xcelerate.deny.build`	Contains a comma-separated list of roles that are not allowed to build Collection assets. Default value: blank
`xcelerate.deny.checkout`	Contains a comma-separated list of roles that are not allowed to checkout assets explicitly from the revision tracking system. Default value: `blank`
`xcelerate.deny.copy`	Contains a comma-separated list of roles that are not allowed to copy assets. Default value: `blank`
`xcelerate.deny.delegate`	Contains a comma-separated list of roles that are not allowed to delegate assigned assets to other participants in the workflow. Default value: `blank`
`xcelerate.deny.delete`	Contains a comma-separated list of roles that are not allowed to delete assets. Default value: `blank`
`xcelerate.deny.edit`	Contains a comma-separated list of roles that are not allowed to edit assets. Default value: `blank`
`xcelerate.deny.inspect`	Contains a comma-separated list of roles that are not allowed to inspect assets. Default value: `blank`
`xcelerate.deny.pastesitenavigation`	Contains a comma-separated list of roles that are not allowed to create a site navigation by copying and pasting an existing site navigation in the SitePlan tree. Default value: `blank`
`xcelerate.deny.placepage`	Contains a comma-separated list of roles that are not allowed to place Page assets in the SitePlan tree. Default value: `blank`
`xcelerate.deny.preview`	Contains a comma-separated list of roles that are not allowed to preview assets with their templates. Default value: `blank`
`xcelerate.deny.removefromgroup`	Contains a comma-separated list of roles that are not allowed to remove assets from a workflow group. Default value: `blank`
`xcelerate.deny.removefromworkflow`	Contains a comma-separated list of roles that are not allowed to remove assets from workflow. Default value: `blank`
`xcelerate.deny.rollback`	Contains a comma-separated list of roles that are not allowed to roll back assets to a previous version. Default value: `blank`
`xcelerate.deny.setExportData`	Contains a comma-separated list of roles that are not allowed to set export to disk (static publishing) starting point. These users may still be allowed to approve and publish assets if some other users set the starting point. Default value: `blank`
`xcelerate.deny.setnestedworkflow`	Contains a comma-separated list of roles that are not allowed to set nested workflow. Default value: `blank`
`xcelerate.deny.setparticipants`	Contains a comma-separated list of roles that are not allowed to set participants for workflow. Default value: `blank`
`xcelerate.deny.setprocessdeadline`	Contains a comma-separated list of roles that are not allowed to set workflow process deadlines. Default value: `blank`
`xcelerate.deny.setstepdeadline`	Contains a comma-separated list of roles that are not allowed to set a deadline on a workflow step. Default value: `blank`
`xcelerate.deny.share`	Contains a comma-separated list of roles that are not allowed to share assets with other sites (other than the site the asset was originally created in). Default value: `blank`
`xcelerate.deny.showparticipants`	Contains a comma-separated list of roles that are not allowed to see the participants for a workflow. Default value: `blank`
`xcelerate.deny.showstatus`	Contains a comma-separated list of roles that are not allowed to see the status screen for assets. The Status option is available in the View menu when you have an asset open in the Oracle WebCenter Sites: Contributor interface. The Status page shows workflow and publishing information about the open asset. If the user belongs to one of the roles that is being denied the privilege to view the Status page, the Status option will be grayed out in the View menu. Default value: `blank`
`xcelerate.deny.showversion`	Contains a comma-separated list of roles that are not allowed to see the list of versions for an asset. Note: The Show versions icon is not displayed on the asset's toolbar if the user belongs to one of the roles that is denied the privilege. Default value: `blank`
`xcelerate.deny.translate`	Contains a comma-separated list of roles that are not allowed to translate assets. Default value: `blank`
`xcelerate.grant.abstainfromvoting`	Contains a comma-separated list of roles that are allowed to abstain from voting when assigned assets as part of the workflow process. Default value: `blank`
`xcelerate.grant.approve`	Contains a comma-separated list of roles that are allowed to approve assets for publishing. Default value: `blank`
`xcelerate.grant.authorize`	Contains a comma-separated list of roles that are allowed to authorize privileges on assets. Default value: `GeneralAdmin,WorkflowAdmin,SiteAdmin`
`xcelerate.grant.build`	Contains a comma-separated list of roles that are allowed to build Collection assets. Default value: `blank`
`xcelerate.grant.checkout`	Contains a comma-separated list of roles that are allowed to checkout assets from the revision tracking system. Default value: `blank`
`xcelerate.grant.copy`	Contains a comma-separated list of roles that are allowed to copy assets. Default value: `blank`
`xcelerate.grant.delegate`	Contains a comma-separated list of roles that are allowed to delegate assigned assets to other participants in the workflow. Default value: `blank`
`xcelerate.grant.delete`	Contains a comma-separated list of roles that are allowed to delete assets. Default value: `blank`
`xcelerate.grant.edit`	Contains a comma-separated list of roles that are allowed to edit assets. Default value: `blank`
`xcelerate.grant.inspect`	Contains a comma-separated list of roles that are allowed to inspect assets. Default value: `blank`
`xcelerate.grant.translate`	Contains a comma-separated list of roles that are allowed to translate assets. Default value: `blank`
`xcelerate.grant.placepage`	Contains a comma-separated list of roles that are allowed to place Page assets in the SitePlan tree. Default value: `blank`
`xcelerate.grant.preview`	Contains a comma-separated list of roles that are allowed to preview assets with their templates. Default value: `blank`
`xcelerate.grant.removefromgroup`	Contains a comma-separated list of roles that are allowed to remove assets from a workflow group. Default value: `blank`
`xcelerate.grant.removefromworkflow`	Contains a comma-separated list of roles that are allowed to remove assets from workflow. Default value: `blank`
`xcelerate.grant.rollback`	Contains a comma-separated list of roles that are allowed to roll back assets to a previous version. Default value: `blank`
`xcelerate.grant.setExportData`	Contains a comma-separated list of roles that are allowed to set an export to disk (static publishing) starting point. Default value: `blank`
`xcelerate.grant.setnestedworkflow`	Contains a comma-separated list of roles that are allowed to set nested workflow. Default value: `blank`
`xcelerate.grant.setparticipants`	Contains a comma-separated list of roles that are allowed to set participants for workflow. Default value: `blank`
`xcelerate.grant.setprocessdeadline`	Contains a comma-separated list of roles that are allowed to set workflow process deadlines. Default value: `blank`
`xcelerate.grant.setstepdeadline`	Contains a comma-separated list of roles that are allowed to set a deadline on a workflow step. Default value: `blank`
`xcelerate.grant.share`	Contains a comma-separated list of roles that are allowed to share assets with other sites (other than the site the asset was originally created in). Default value: `blank`
`xcelerate.grant.showparticipants`	Contains a comma-separated list of roles that are allowed to see the participants for a workflow. Default value: `blank`
`xcelerate.grant.showstatus`	Contains a comma-separated list of roles that are allowed to see the status screen for assets. The Status option is available in the View menu when you have an asset open in the Contributor interface. The Status page shows workflow and publishing information about the open asset. If the user belongs to one of the roles that is being granted the privilege to view the Status page, the Status option will be grayed out in the View menu. Default value: `blank`
`xcelerate.grant.showversion`	Contains a comma-separated list of roles that are allowed to see the list of versions for an asset. Note: The Show versions icon is displayed on the asset's toolbar if the user belongs to one of the roles that is granted the privilege. Default value: `blank`
`X-XSS-Protection`	Specifies the X-XSS-Protection HTTP response header that allows the web server to enable or disable the web browser's XSS protection mechanism. The following list provides the possible values and the respective implications of setting the value: Possible values: 0: Disables XSS Protection 1: Enables XSS Protection. 1; mode=block: Enables XSS Protection and prevents the browser to render pages if a potential XSS reflection attack is detected. Default value: `1` Subcategory: General
`X-Content-Type-Options`	Specifies the Anti-MIME-Sniffing header X-Content-Type-Options. Default value: `nosniff` Subcategory: General