Does Liferay DXP 7.1 support HTTP headers?

Issue

• Does Liferay DXP 7.1 support the following HTTP headers: "X-Frame-Options", "X-XSS-Protection" and "X-Content-Type-Options"? If not, what changes have to be done from the application side to enable the same

Environment

• Liferay DXP 7.1

Resolution

• Liferay portal is already secured with the following headers and it has been enabled by default. It has been described in the system.properties of Liferay DXP 7.1.
  

  #
      # Set this to true for the portal to send the "X-Frame-Options: DENY" HTTP
      # header to protect against clickjacking.
      #
      # Custom HTTP header values instead of "DENY" can be specified per URL via
      # the properties "http.header.secure.x.frame.options.*".
      #
      http.header.secure.x.frame.options=true

      #
      # Set this to nonempty value for the portal to send the "X-XSS-Protection"
      # HTTP header to block cross-site scripting attacks. Possible nonempty
      # values are "0", "1" and "1; mode=block"
      #
      http.header.secure.x.xss.protection=1

      #
      # Set this to true for the portal to send the "X-Content-Type-Options:
      # nosniff" HTTP header to protect against MIME sniffing. Custom URLs can
      # specified in the property
      # "http.header.secure.x.content.type.options.urls.excludes" that allow for
      # unhindered MIME sniffing.
      #
      http.header.secure.x.content.type.options=true

  Please refer to the below screenshot.
  
  
• As the HTTP security headers are enabled by default, no action is required to enable the same.

Additional Information

• Introduction to Securing Liferay DXP