Improved security for loading Zenya into the frame of an external web application
At Infoland, information security and privacy are high on the agenda. You should always be able to trust that your organisation's data, personal data in particular, is safe. This means that we are continuously improving the security of our platform and products. The result of this is the improvement below.
Currently, some organisations use the ability to load a page from Zenya or one of the Zenya Cloud Services into the frame of an external web application. For Zenya, you can think of an Intranet or, for example, an EHR/ECD. For Zenya Cloud Services, you can think of offering an external form, or displaying a webshare document, on your organisation's website.
Until Zenya 7.0, it was only possible to do this for all allow external websites.
Loading Zenya Cloud Services into the frame of an external web application
In Zenya 7.0, we are therefore adding the so-called frame-ancestors attribute to the Content Security Policy (CSP) of the Zenya Cloud Services listed below so that this access can be restricted.
- Zenya DOC - Webshares
- Zenya CHECK - External questionnaires
- Zenya FLOW - External forms
The frame-ancestors attribute specifies whether the web page in question may be loaded into a frame of another website, among other things. Limiting this prevents attackers from loading a web page within their own malicious site. In particular, this provides protection against the Clickjacking attack technique.
However, there are cases where, as an organisation, you do want to allow a web page from Zenya Cloud Services to be loaded into an external web application. For example, think of offering an external form, or displaying a web share document, on your organisation's website.
To prevent your organisation from getting into trouble after the rollout of the Zenya 7.0 update, we initially give the frame-ancestors attribute the value *. This still allows the web page to be loaded into a frame of another website, among other things, so it does not effectively provide protection yet.
In Zenya 7.1, we want to actually start activating the security provided by frame-ancestors by giving the attribute the value 'self' instead of the *.
For organisations that have indicated to us which website(s) should also be allowed, we will also add them to the frame-ancestors attribute (as the value of the attribute is organisation-specific).
So if your organisation would like to be able to load one or more of the above Zenya Cloud Services within another website, please contact our service desk so that we can register this website(s) in your organisation's Zenya.
Loading a Zenya page into the frame of an external web application
In Zenya 7.0, we allow specific websites to be added to the frame-ancestors attribute in the Content Security Policy (CSP) of Zenya itself.
The frame-ancestors attribute specifies whether the web page in question may be loaded into a frame of another website, among other things. Limiting this prevents attackers from loading a web page within their own malicious site. In particular, this provides protection against the Clickjacking attack technique.
Zenya's default setting (also for 7.0) was already that loading Zenya into an external web application was not allowed.
The above enhancement therefore only applies to organisations that have explicitly indicated to us in the past that Zenya should be able to be loaded into an external web application. These specific organisations have also since been contacted by Infoland by email to activate the above enhancement.
No action is therefore required for organisations that have not been contacted by us.