Customize Security in EMS Web App

(EMS Internal Documentation)

Through the web.config file and parameter settings, you can enhance security features in the EMS Web App to meet your organization's needs. This topic provides information about the following security settings:

Limit File Size for Reservation Attachments

A setting in the web.config file limits the file size for reservation attachments to 50 MB. You can edit this file size limit by modifying the web.config file. You can also limit the file size of calendar-enabled attachments (Exchange and G Suite). Refer to Limit File Size of Calendar-Enabled Attachments for more information.

To edit the file size limit:

  1. Open the EMS Web App web.config file. The typical path is C:\inetpub\wwwroot\EMSWebApp\web.config.

  2. In the web.config file, locate the requestLimits node under <requestFiltering>.

    <requestFiltering>
      <requestLimits maxAllowedContentLength="51200000"/>
    </requestFiltering>

  3. Edit the <requestLimits> node's value according to your maximum file size requirements.

    The default maximum file size is 51200000 bytes (50 MB). When specifying a different maximum file size, make sure to enter the value in bytes. If you remove the <requestLimits> node from the web.config file, the hard-coded file size limit of 4096000 bytes (4 MB) will go into effect.

  4. Save the web.config file.

  5. Restart the website.

Limit File Size of Calendar-Enabled Attachments

For EMS Web App, the default file size limit is 8 MB for calendar-enabled reservation attachments (Exchange and G Suite). To modify this file size limit, please contact EMS Support. A support representative will need to access the hidden parameter PAM_MaxAttachmentSize in your EMS database.

Parameter for specifying the maximum file size limit for calendar-enabled reservation attachments (Exchange and G Suite):

  • Display Value – PAM Maximum size of attachment to allow

  • Keyvalue – PAM_MaxAttachmentSize

  • Default Size –  8000 kB (8 MB)

When modifying the default maximum file size for calendar-enabled attachments, make sure to specify the size in kilobytes.

Customize HTTP Security Headers

HTTP security headers tell the browser how to behave when handling a website's content and data. Using security headers can improve web security; for example, using the strict-transport-security header forces the browser to communicate solely over HTTPS.

EMS CLOUD CUSTOMERS – Modifications to the web.config file must be performed by EMS Cloud Operations. To request these changes, please contact EMS Support.

The following table lists the security headers that can be configured in the EMS Web App's web.config file.

Security Headers Available for Configuration in EMS Web App

HTTP Security Header

Default

Description

X‑Frame‑Options

Disabled

This header indicates whether a browser should be allowed to render a page in a <frame>, <iframe>, or <object>. By default, the x-frame-options header is disabled. To enable this header, edit the web.config file.

If you want to enable the x-frame-options header and your company uses the Skype for Business Integration, the header must be configured with values that are appropriate for your EMS Web App configuration.

X‑Content‑Type‑Options

Enabled

This header blocks content sniffing by instructing the browser to follow the MIME types indicated in the header.

Strict‑Transport‑Security

Disabled

This header forces communication using HTTPS instead of HTTP. By default, the strict-transport-security header is disabled. To enable this header, you will need to edit the web.config file.

The strict-transport-security header is only valid if you are using SSL/HTTPS.

Content‑Security‑Policy

Disabled

This header can prevent attacks, such as cross-site scripting, by defining content sources that are approved and allowing the browser to load them. By default, the content-security-policy header is disabled. To enable this header, you will need to edit the web.config file.

If your company uses the Skype for Business Integration and you want to enable the content-security-policy header, you must configure this header with appropriate values.

Configure Security Headers

To configure HTTP security headers, you will need to edit the web.config file as follows: 

EMS Cloud Customers – EMS Cloud Operations must perform modifications to the web.config file. To request these changes, contact EMS Support.

  1. Open the EMS Web App web.config file. The typical path is C:\inetpub\wwwroot\EMSWebApp\web.config.

  2. In the web.config file, locate the header nodes under <customHeaders>.

    <httpProtocol>
      <!-- security-specific http headers -->
      <customHeaders>
        <!--<add name="X-Frame-Options" value="deny" />--><!-- valid only when NOT using Skype 
    integration - can be configured with 'allow-from' when using Skype -->
        <add name="X-Content-Type-Options" value="nosniff"/>
        <!--<add name="Strict-Transport-Security" value="max-age=31536000"/>--><!-- valid only when
    using SSL/HTTPS -->
        <!--<add name="Content-Security-Policy" value="default-src 'self'"/>--><!-- valid only when
    NOT using Skype integration - can be configured with appropriate values when using Skype -->
      </customHeaders>
    </httpProtocol>

  3. Edit the <customHeaders> nodes:

    • To enable a security header, uncomment the header by removing the "<!‑‑" and "‑‑>" from the beginning and end of the header statement. Make sure to set the header value according to your EMS Web App configuration and your company's specifications.

      Some security header values are not valid with the Skype for Business Integration. Refer to the Security Headers table for more information.

    • To disable a security header, comment out the header by adding the "<!‑‑" and "‑‑>" to the beginning and end of the header statement.

  4. Save the web.config file.

  5. Restart the website.