Configure the P3P header
Administrators who deploy WebSEAL servers as part of the security solution for their Web servers must specify the P3P compact policy for their site. This step requires determining policy for each of the privacy settings defined by the P3P specification. WebSEAL provides a default policy that is accepted by the default settings for the Microsoft Internet Explorer 6 browser. Web administrators should modify the default policy as needed to match the site policies for handling of user data in cookies. Web administrators should test use of their policies with Internet Explorer 6 to ensure the WebSEAL cookies continue to be accepted by Internet Explorer 6 browsers.
Web administrators should consult the P3P specification when defining their site policy.
Multiple values are allowed for each configuration entry, with the exception of the entries that require a value of "yes" or "no". When a particular configuration entry is not declared, no indicators are added to the compact policy for that entry.
To configure the P3P compact policy for use with WebSEAL, complete the following steps:
Steps
- Open the WebSEAL configuration file for editing. Go to the [server] stanza.
- Decide if P3P headers from junctioned servers will be replaced or preserved. Set the following value:[p3p-header] preserve-p3p-policy = {yes|no}
Default is "no". Set this to "yes" if we want to preserve P3P headers. For information, see Junction header preservation
- Go to the [p3p-header] stanza. Specify the access the user will have to the information in the cookie. Set the value for the following entry:
[p3p-header] access = {none|all|nonident|contact-and-other|ident-contact|other-ident}. The default setting is:[p3p-header] access = none
Value Description none
No access to identified data is given.all
Access is given to all identified data.nonident
Web site does not collect identified data.contact-and-other
Access is given to identified online and physical contact information as well as to certain other identified data.ident-contact
Access is given to identified online and physical contact information. For example, users can access things such as a postal address.other-ident
Access is given to certain other identified data. For example, users can access things such as their online account charges.
- Type of information stored in the cookies or linked to by the cookies. Set the value for the following entry:
[p3p-header] categories = {physical|online |uniqueid|purchase|financial|computer |navigation| interactive|demographic |content|state|political|health |preference|location| government|other-category}The default setting is:
[p3p-header] categories = uniqueid
Value Description physical
Information that allows an individual to be contacted or located in the physical world. For example, telephone number or address.online
Information that allows an individual to be contacted or located on the Internet.uniqueid
Non-financial identifiers, excluding government-issued identifiers, issued for purposes of consistently identifying or recognizing the individual.purchase
Information actively generated by the purchase of a product or service, including information about the method of payment.financial
Information about an individual's finances including account status and activity information such as account balance, payment or overdraft history, and information about an individual's purchase or use of financial instruments including credit or debit card information.computer
Information about the computer system the individual is using to access the network. For example, IP number, domain name, browser type, or operating system.navigation
Data passively generated by browsing the Web site. For example, which pages are visited, and how long users stay on each page.interactive
Data actively generated from or reflecting explicit interactions with a service provider through its site. For example, queries to a search engine, or logs of account activity.demographic
Data about an individual's characteristics. For example, gender, age, and income.content
The words and expressions contained in the body of a communication. For example, the text of email, bulletin board postings, or chat room communications.state
Mechanisms for maintaining a stateful session with a user or automatically recognizing users who have visited a particular site or accessed particular content previously. For example, HTTP cookies.political
Membership in or affiliation with groups such as religious organizations, trade unions, professional associations and political parties.health
Information about an individual's physical or mental health, sexual orientation, use or inquiry into health care services or products, and purchase of health care services or products.preference
Data about an individual's likes and dislikes. For example, favorite color or musical tastes.location
Information that can be used to identify an individual's current physical location and track them as their location changes. For example, Global Positioning System position data.government
Identifiers issued by a government for purposes of consistently identifying the individual.other-category
Other types of data not captured by the above definitions.
- Specify whether the full P3P policy contains some information regarding disputes over the information contained within the cookie. Set the value for the following entry:
[p3p-header] disputes = {yes|no}The disputes entry is not specified by default in the WebSEAL configuration file. The P3P specification states that when the dispute entry is not specified, the default value no is automatically assigned.
Value Description yes The full P3P policy contains information regarding disputes over the information contained within the cookie. no The full P3P policy does not contain information regarding disputes over the information contained within the cookie.
- Types of remedies in case a policy breach occurs. Set the value for the following entry:
[p3p-header] remedies = {correct|money|law}
The default setting is:
[p3p-header] remedies = correct
Value Description correct Errors or wrongful actions arising in connection with the privacy policy will be remedied by the service. money If the service provider violates its privacy policy, it will pay the individual an amount specified in the human readable privacy policy or the amount of damages. law Remedies for breaches of the policy statement will be determined based on the law referenced in the human readable description.
- Specify either that no data is collected (including Web logs), or the organization collecting the data will make anonymous any information that identifies the user. Set the value for the following entry:
[p3p-header] non-identifiable = {yes|no}The non-identifiable entry is not specified in the WebSEAL configuration file. The P3P specification states that when the non-identifiableentry is not specified, the default value is automatically assigned no.
Value Description yes Data that is collected identifies the user. no No data is collected (including Web logs), or the information collected does not identify the user.
- Purpose of the information in the cookie. Set the value for the following entry:
[p3p-header] purpose = {current|admin|develop|tailoring|pseudo-analysis|pseudo-decision| individual-analysis|individual-decision|contact|historical| telemarketing|other-purpose} [:[opt-in|opt-out|always]]The default setting is:[p3p-header] purpose = current
Value Description current
Information can be used by the service provider to complete the activity for which it was provided.admin
Information can be used for the technical support of the Web site and its computer system.develop
Information can be used to enhance, evaluate, or otherwise review the site, service, product, or market.tailoring
Information can be used to tailor or modify content or design of the site where the information is used only for a single visit to the sitepseudo-analysis
Information can be used to create or build a record of a particular individual or computer that is tied to a pseudonymous identifier, without tying identified data to the record. This profile will be used to determine the habits, interests, or other characteristics of individuals for purpose of research, analysis and reporting.pseudo-decision
Information can be used to create or build a record of a particular individual or computer that is tied to a pseudonymous identifier, without tying identified data to the record. This profile will be used to determine the habits, interests, or other characteristics of individuals to make a decision that directly affects that individual.individual-analysis
Information can be used to determine the habits, interests, or other characteristics of individuals and combine it with identified data for the purpose of research, analysis and reporting.individual-decision
Information can be used to determine the habits, interests, or other characteristics of individuals and combine it with identified data to make a decision that directly affects that individual.contact
Information can be used to contact the individual, through a communications channel other than voice telephone, for the promotion of a product or service.historical
Information can be archived or stored for the purpose of preserving social history as governed by an existing law or policy.telemarketing
Information can be used to contact the individual with a voice telephone call for promotion of a product or service.other-purpose
Information can be used in other ways not captured by the above definitions.
For each value specified for purpose, except the value current, we can optionally specify the opt-in policy. The syntax consists of a colon ( : ) immediately following the purpose value, followed by one of the supported values for the opt-in policy. For example: [p3p-header] purpose = telemarketing:opt-in.
The following table lists the supported values:
Value Description opt-in
Data can be used for this purpose only when the user affirmatively requests this use.opt-out
Data can be used for this purpose unless the user requests that it not be used in this way.always
Users cannot opt-in or opt-out of this use of their data.
This is the default value. When the opt-in policy is not specified, the always policy applies.
- Recipients of the information in the cookie. Set the value for the following entry):
[p3p-header] recipient = {ours|delivery|same|unrelated|public|other-recipient} [:[opt-in|opt-out|always]]The default setting is:
[p3p-header]
recipient = ours
Value Description ours
Ourselves and/or entities acting as our agents, or entities for whom we are acting as an agent. An agent is a third party that processes data only on behalf of the service provider.delivery
Legal entities performing delivery services that may use data for purposes other than completion of the stated purpose.same
Legal entities following our practices. These are legal entities who use the data on their own behalf under equable practices.unrelated
Unrelated third parties. These are legal entities whose data usage practices are not known by the original service provider.public
Public forums. These are public forums such as bulletin boards, public directories, or commercial CD-ROM directories.other-recipient
Legal entities following different practices. These are legal entities that are constrained by and accountable to the original service provider, but may use the data in a way not specified in the service provider's practices.
For each value specified for recipient, excepting ours, we can optionally specify the opt-in policy. The syntax consists of a colon ( : ) immediately following the recipient, followed by one of the supported values for the opt-in policy. For example:[p3p-header] recipient = delivery:opt-inThe following table lists the supported values:
Value Description opt-in
Data can be used for this purpose only when the user affirmatively requests this use.opt-out
Data can be used for this purpose unless the user requests that it not be used in this way.always
Users cannot opt-in or opt-out of this use of their data.
This is the default value. When the opt-in policy is not specified, the always policy applies.
- How long the information in the cookie is retained. Set the value for the following entry:
[p3p-header] retention = {no-retention|stated-purpose|legal-requirement|business-practices| indefinitely}The default setting is:[p3p-header] retention = no-retention
Value Description no-retention
Information is not retained for more than the brief period of time necessary to make use of it during the course of a single online interaction.stated-purpose
Information is retained to meet the stated purpose, and is to be discarded at the earliest time possible.legal-requirement
Information is retained to meet a stated purpose, but the retention period is longer because of a legal requirement or liability.business-practices
Information is retained under a service provider's stated business practices.indefinitely
Information is retained for an indeterminate period of time.
- Optionally, specify a reference to a full XML compact policy file. Specify a value for the following entry:[p3p-header] p3p-element = policyref=url_to_default_location_of_full_policy
This entry is present but commented out, and therefore not active, in the default WebSEAL configuration file. The default entry is the default location for the full policy on any Web site.
[p3p-header] # p3p-element = policyref=="/w3c/p3p.xml"
When p3p-element is not set, browsers look by default for the full policy in /w3c/p3p.xml. Note that some browsers might not refer to p3p-element but proceed directly to /w3c/p3p.xml.
Ensure that unauthenticated access is granted to /w3c/p3p.xml. See P3P configuration troubleshooting.
Parent topic: Platform for Privacy Preferences (P3P)