For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

swo0sh_gt_13163's avatar
swo0sh_gt_13163
Icon for Altostratus rankAltostratus
Aug 30, 2015

Clickjacking protection using X-FRAME-OPTIONS: ALLOW-FROM URI

Hello Folks,

 

Can anyone help by sharing a snippet of iRule by inserting XFRAME-OPTIONS:ALLOW-FROM (single / multiple URI)?

 

The requirement is to allow certain Frames from different applications hosted within the same environment. Since X-FRAME-OPIONS:Allow-from supports only 1 URI, can we create any iRule to embed multiple URI for "Allow-from" header?

 

Perhaps using String based Data group, and call that Data group within an iRule, and verify if the URI is part of the Data group?

 

Thank you mates! Cheers!

 

application delivery
clickjakcing
devops
iRules

1 Reply

  • Zeeshan_Ahmad_1's avatar
    Zeeshan_Ahmad_1
    Icon for Nimbostratus rankNimbostratus
    Dec 10, 2015

    Hi Darshan,

    Note that in X-Frame-Options header Allow-From token does not support wildcards or listing of multiple origins and it is not supported by couple of browsers as well, you can use the below irule where you can mention the URL from where you want to make it accessible

     when HTTP_RESPONSE {
   HTTP::header replace X-Frame-Options "ALLOW-FROM http://www.mysite.com"
}