[Feature request] VBM 365 Restore Portal - HTTP header fields

[jan.ohrndorf]

Based on a security analysis of our VBM 365 environment, I was asked to add the following HTTP header fields to the Restore Portal in order to increase security:
- Cache-Control
- Content-Security-Policy
- X-Content-Type-Options

Since a change to the headers mentioned can only be implemented by Veeam, I am submitting this feature request.

Is adding these headers a valuable enhancement, and would it actually increase security? Or can these headers be omitted?

Many thanks in advance for your response and your opinions!

[Mildur]

Hi Jan,

Thank you for your request.
I can’t comment on whether it increases security, but I’ll forward it to our internal security team for review.

Best regards,
Fabian

[jan.ohrndorf]

Hi Fabian,

thank you very much!

Best regards
Jan

[Mildur]

Hi Jan,

Our team verified the mentioned HTTP headers with our recently released v8.4. All headers are already provided in the response.
Can you please update to Veeam Backup for Microsoft 365 v8.4 (Release Information) and try again?
If you still don’t see these headers, please provide the exact URLs you’re testing and screenshots of the response headers.



Best,
Fabian

[jan.ohrndorf]

Hello Fabian,

That's really great news!
We'll update our environment as soon as possible.
Thank you so much for your support!

BR Jan