Forum Discussion

swo0sh_gt_13163's avatar
swo0sh_gt_13163
Icon for Altostratus rankAltostratus
Aug 30, 2015

Clickjacking protection using X-FRAME-OPTIONS: ALLOW-FROM URI

Hello Folks,   Can anyone help by sharing a snippet of iRule by inserting XFRAME-OPTIONS:ALLOW-FROM (single / multiple URI)?   The requirement is to allow certain Frames from different applicat...
application delivery
clickjakcing
devops
iRules
Zeeshan_Ahmad_1's avatar
Zeeshan_Ahmad_1
Icon for Nimbostratus rankNimbostratus
Dec 10, 2015

Hi Darshan,

Note that in X-Frame-Options header Allow-From token does not support wildcards or listing of multiple origins and it is not supported by couple of browsers as well, you can use the below irule where you can mention the URL from where you want to make it accessible

 when HTTP_RESPONSE {
   HTTP::header replace X-Frame-Options "ALLOW-FROM http://www.mysite.com"
}