# Ood-portal.conf security headers location

**URL:** <https://discourse.openondemand.org/t/ood-portal-conf-security-headers-location/1805>\
**Category:** Get Help\
**Tags:** question\
**Created:** [November 22, 2021, 9:35pm UTC](https://discourse.openondemand.org/t/ood-portal-conf-security-headers-location/1805 "2021-11-22T21:35:36Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![karcaw](https://sea1.discourse-cdn.com/flex015/user_avatar/discourse.openondemand.org/karcaw/32/745_2.png) [@karcaw](https://discourse.openondemand.org/u/karcaw)\
**Post date:** [November 22, 2021, 9:35pm UTC](https://discourse.openondemand.org/t/ood-portal-conf-security-headers-location/1805/1 "2021-11-22T21:35:36Z")

</div>

What is the best way to add apache directives that turn on and off security features? For example, we normally add things like this:

- FileETag None
- TraceEnable off
- Header unset “X-Powered-By”
- Header unset “Via”
- Header unset “ETag”

to our apache configs. I have been abusing the ssl: yaml tag in my ood\_portal.yml file as it seems to get the flags in there appropriately. Is there another tag I should be using? or should I be placing items like that in another config file completely, and not configure it with Open OnDemand?

---

<div class="post-metadata">

**Author:** ![tdockendorf](https://sea1.discourse-cdn.com/flex015/user_avatar/discourse.openondemand.org/tdockendorf/32/202_2.png) [@tdockendorf](https://discourse.openondemand.org/u/tdockendorf)\
**Post date:** [November 24, 2021, 9:16pm UTC](https://discourse.openondemand.org/t/ood-portal-conf-security-headers-location/1805/2 "2021-11-24T21:16:35Z")

</div>

What directive do you usually put those under? Is it under the entire `VirtualHost` or the `Directory` or a `Location`? If you are overloading the `ssl` tag I’m guessing you put these for the entire VirtualHost. You could also overload the `auth` directive to embed those settings under the various `Location` and `LocationMatch` blocks that require authentication.

There is an issue for this: [Support adding arbitrary Apache directives to sections of ood-portal.conf · Issue #708 · OSC/ondemand · GitHub](https://github.com/OSC/ondemand/issues/708#issuecomment-715578590) - if that proposed solution looks like it might work, let us know and we can try and get this into future 2.1 release

---

<div class="post-metadata">

**Author:** ![karcaw](https://sea1.discourse-cdn.com/flex015/user_avatar/discourse.openondemand.org/karcaw/32/745_2.png) [@karcaw](https://discourse.openondemand.org/u/karcaw)\
**Post date:** [December 7, 2021, 6:34pm UTC](https://discourse.openondemand.org/t/ood-portal-conf-security-headers-location/1805/3 "2021-12-07T18:34:01Z")

</div>

Yes i think the solution will work for me

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/flex015/uploads/osc/original/2X/b/bae70bd0ed39a3ae769c2108155f4cb3e9da8385.png) [@system](https://discourse.openondemand.org/u/system)\
**Post date:** [June 5, 2022, 6:34pm UTC](https://discourse.openondemand.org/t/ood-portal-conf-security-headers-location/1805/4 "2022-06-05T18:34:56Z")

</div>

Closed on June 5, 2022, 6:34pm UTC

This topic was automatically closed 180 days after the last reply. New replies are no longer allowed.