<?xml version="1.0" encoding="UTF-8"?>

<!-- ======================================================================== -->
<!--                                                                          -->
<!-- Response header configuration for the Runtime Applications               -->
<!--                                                                          -->
<!-- For each header, you can optionally specify a list of semi-column (;)    -->
<!-- separated URL patterns that should include or exclude this header in the -->
<!-- response using the include-patterns or exclude-patterns attributes       -->
<!-- respectively. Use a wildcard (*) at the beginning to match multiple 	  -->
<!-- URLs.                                                                    -->
<!--                                                                          -->
<!-- Note that only either one of include-patterns or exclude-patterns must   -->
<!-- be specified per header.                                                 -->
<!-- Example:                                                                 -->
<!--    */idp/startSLO.ping;*/sp/SLO.saml2                                    -->
<!--                                                                          -->
<!-- ======================================================================== -->

<con:config xmlns:con="http://www.sourceid.org/2004/05/config">
    <!-- ===================================================================== -->
    <!-- HTTP Strict Transport Security (HSTS) response header field           -->
    <!-- ===================================================================== -->
    <!-- The HSTS response header forces the user's browser to use the https   -->
    <!-- protocol while connecting to PingFederate's runtime applications.     -->
    <!--                                                                       -->
    <!-- This response header can also be configured for the PingFederate      -->
    <!-- administrative console in response-header-admin-config.xml. It is     -->
    <!-- important to note that if you have the administrative console and     -->
    <!-- runtime applications exposed to your end users using different domain -->
    <!-- names, then the two HSTS headers can be configured independently. But -->
    <!-- if your administrative console and runtime applications are           -->
    <!-- represented with the same domain, then it's best to configure the two -->
    <!-- HSTS headers to be the same.                                          -->
    <!--                                                                       -->
    <!-- Uncomment the map below to add the HSTS header to all responses       -->
    <!-- on the current domain.                                                -->
    <!--
    <con:map name="Strict-Transport-Security">
        <con:item name="value">max-age=31536000</con:item>
        <con:item name="include-patterns">*</con:item>
    </con:map>
    -->

    <!-- ===================================================================== -->
    <!-- HTTP X-Frame-Options response header field                            -->
    <!-- ===================================================================== -->
    <!-- This header is used to indicate whether or not a browser should be    -->
    <!-- allowed to render a page in a frame or iframe.                        -->
    <!--                                                                       -->
    <!-- This response header can also be configured for the PingFederate      -->
    <!-- runtime application in response-header-admin-config.xml.              -->
    <!--                                                                       -->
    <con:map name="X-Frame-Options">
        <con:item name="value">SAMEORIGIN</con:item>
        <!-- <con:item name="include-patterns"></con:item> -->
        <con:item name="exclude-patterns">
            */idp/startSLO.ping;*/sp/startSLO.ping;*/idp/SLO.saml2;*/sp/SLO.saml2;*/idp/SLO.ping;*/sp/SLO.ping;*/fc-logout.openid;*/resume/sp/fc-logout.ping;*/idp/init_logout.openid;*/sp/post-logout.openid
        </con:item>
    </con:map>

    <!-- ===================================================================== -->
    <!-- HTTP Referrer-Policy response header field                            -->
    <!-- ===================================================================== -->
    <!-- This header is used to indicate which referrer information, sent in   -->
    <!-- the Referer header, should be included with requests made.            -->
    <!--                                                                       -->
    <con:map name="Referrer-Policy">
        <con:item name="value">origin</con:item>
        <con:item name="include-patterns">*</con:item>
    </con:map>

    <!-- ===================================================================== -->
    <!-- Additional Configurations                                             -->
    <!-- ===================================================================== -->
    <!-- This configuration is used to indicate whether or not the response    -->
    <!-- headers above should be applied to the /pf-ws/* and /pf-scim/*        -->
    <!-- endpoints.                                                            -->
    <!-- (previously these endpoints were not affected by the configurations   -->
    <!-- in this file)                                                         -->
    <!--                                                                       -->
    <con:item name="apply-headers-to-all-runtime-wars" defaultForUpgrade="false">true</con:item>
</con:config>
