Stricter security for Next® on the web

When you expose your Next® Digital workplace to the open Internet, either because you use Next® as a Service, use your own cloud provider, or simply allow external users to access your on-prem Next®, it is of course immensely important that the connection is secure.


it is immensely important that the connection to Next® is secure.


By default, Next® runs over strongly encrypted connections using Transport Layer Security (TLS 1.3).  

With the May'22 release we take additional steps by allowing you to set more of the so-called HTTP headers.

This means that by default Next® gets green security reports from services like Security Headers and SSL Labs.


As good as it gets - but only if your are up to date


As good as it gets - also on SSL 


For a comparison, the Office 365 we use at Nextway has a somewhat lower rating.


Microsoft is not pixel perfect


Next® will keep you safe, but only if you keep your Next® up to date!

For the techies

New header seetings:

X-Frame-Options: SAMEORIGIN

X-Content-Type-Options: nosniff

Referrer-Policy: strict-origin-when-cross-origin

Content-Security-Policy: object-src 'none'

Permissions-Policy: autoplay=(self)


Our proxy sets;

Strict-Transport-Security: max-age=63072000; includeSubdomains;

Commercial terms and conditions

These new feature are available, at no additional cost, to users with an active service plan. Any consultancy assistance will be invoiced.

Disclaimer

Despite our best efforts, we may be forced to change both content and expected delivery of future product updates without notice.  


Details

Title:

Stricter security for Next® on the web

Type:

New features

Status:

Released

Release time:

May 2022

Affected products:

Next® Contracts
Next® Emails
Next® Enterprise Archive
Next® Invoices
Next® Mailroom

Audience:

Next® users

Classification:

Public

Responsible product manager:

Kim Hellum

Updated:

29.04.2022

By:

Kim Hellum