In the ShowEdit dialog, in the Client-Side Certificate field, select Required.

Configuring Security 5-17

5.6 Configuring HTTP Request Header Size

By default, Oracle Web Cache provides the following limits for HTTP request header field: ■ 819000 bytes for the total sum of all HTTP request header fields in requests Oracle recommends setting the header size to a lower value than the default to ensure security and prevent denial-of-service attacks from malicious clients. If the length of the request is larger than the allowed limit,Oracle Web Cache sends an error to the client and reports the error 11356 to the event log: Total request header length exceeds configured maximum. A forbidden error response is returned to the client. ■ 8152 bytes for an individual HTTP request header field Oracle recommends setting the individual header size based on how large an application sets HTTP requests header fields. If the length of the request is larger than the allowed limit, Oracle Web Cache sends an error to the client and reports the error 11355 to the event log: Single request header length exceeds configured maximum. A forbidden error response is returned to the client. To modify the default header limits:

1. From Oracle Web Cache Manager, in the navigator frame, select Properties

Security . See Section 2.7.2 . The Security page appears.

2. In the HTTP Request Header Limits section of the Security page, click Edit.

The HTTP Request Header Limits dialog box appears.

3. In the Maximum combined header size in bytes field, specify the total sum of all

HTTP request header fields in requests. Specify a limit of at least 4096 bytes 4 KB.

4. In the Maximum individual header size in bytes field, specify the allowed length

limit of an individual HTTP request header fields. Specify a limit of at least 256 bytes.

5. Click Submit, and then click Apply Changes.

6. Restart Oracle Web Cache. See Section 2.13 .

5.7 Ensuring That ClientIP Headers Are Valid

A client, such as a browser, can send information about its IP address in a header in a request. However, because a client could use a false IP address in the header, allowing a cache to forward that information to another cache or to the origin server can be a potential security problem. By default, Oracle Web Cache removes any IP header information forwarded from a client and replaces it with a header that contains the correct IP address of the client. In this case, a client can be a browser or another cache in a hierarchy. In a cache hierarchy, Oracle Web Cache must be able to preserve the information that is forwarded from one cache to another in the hierarchy or from a cache to the origin server. To configure these settings: