# Configuring Web Security Settings

The **Web Security Settings** section allows Administrators to configure settings that prevent malicious execution of code either on **Solar Archive** itself, or on the end user PC via the **Solar Archive** Web.

1. Navigate to **Adv Configuration** > **Web Security Settings.**
2. Enter / Select the required values in the fields. Refer to the table below for field names and descriptions.
3. Click "Save"

{% hint style="info" %}
**Note**: Please hover over the on-screen information for additional information about field names and related areas.
{% endhint %}

| Field                                                                     | Description                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              |
| ------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
| **Referrer Validation Level**                                             | Validation level for links coming from referrer sites.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                   |
| **Allowed Referrer Hosts**                                                | <p>List of hostnames / host addresses from which URL links to <strong>Solar Archive</strong> web will be allowed. This field plays two key roles:<br><br>- <strong>Intranet links to Solar Archive</strong>: To prevent websites that you are not aware of from linking to this <strong>Solar Archive</strong> system. In theory, a malicious third party web site may try to mask the <strong>Solar Archive</strong> web behind its own UI. Therefore, for your internal intranet web or any other portals that you know about that link to the <strong>Solar Archive</strong> web you will need to add their hostname to the referrer list here. Without this your users will see an “Unknown Referrer – access denied” message – showing the referrer hostname that is not known to <strong>Solar Archive</strong>.<br><br>- <strong>Stubbing URL Links when security is enabled (transport agent / OWA Plugin)</strong>: Stubbing services will convert attachments in Exchange Emails to URL links. These URL links will open the attachment from <strong>Solar Archive</strong>. If Stubbing URL Security is enabled then every time a Stub URL link is followed, <strong>Solar Archive</strong> will try to obtain the users username to see if they are valid to view the attachment \[a sender or recipient of the email containing the attachment]. However, to allow the “Transport Agent” and the “OWA Plug-in” will also follow these URL links. However they will need to bypass the security check. So enter the server name / IP address on which the Transport Agent and OWA Plug-In are installed.</p> |
| **Malicious web parameter handling**                                      | Action that should be taken to handle malicious web parameter.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                           |
| **Filter web parameters with AntiSamy**                                   | Specifies whether or not the feature of filtering web parameters with AntiSamy is turned On.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                             |
| **Display HTML editor controls**                                          | Specifies whether HTML editor controls are shown or hidden to the users.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                 |
| **Ensure HttpOnly cookie**                                                | Specifies whether or not HttpOnly cookie should be used to prevent illegitimate access.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  |
| **Force a login check for stubbing URL Links**                            | Specifies whether or not users are checked and must be a sender or recipient of the email that contains the attachment.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  |
| **Protection against framing attacks**                                    | Specifies whether or not other websites should be prevented from framing pages of **Solar Archive** web application.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                     |
| **Discard web requests containing unsafe characters in ‘referer’ header** | Specifies whether or not referer headers, in web requests, are checked, for potentially unsafe value.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    |