Forum Discussion

Moinul_Rony's avatar
Moinul_Rony
Icon for Altostratus rankAltostratus
Aug 27, 2013

Clickjacking protection with X-Frame options

We have a situation where sites are missing X-Frame Options How can we return a response header with the name X-Frame-Options and the value DENY to prevent framing altogether, or the value SAMEORIGIN to allow framing only by pages on the same origin as the response itselfSecure Cookies

 

I found the following single line iRule implementation, can you please verify

 

when HTTP_RESPONSE { HTTP::header insert "X-FRAME-OPTIONS" “(DENY || SAMEORIGIN)” }

 

  • Kevin_Stewart's avatar
    Kevin_Stewart
    Icon for Employee rankEmployee
    Aug 27, 2013

    I'd use a replace:

    when HTTP_RESPONSE {
   HTTP::header replace X-Frame-Options "SAMEORIGIN"
}
  • Deepak__M_K_165's avatar
    Deepak__M_K_165
    Icon for Nimbostratus rankNimbostratus
    Oct 24, 2014

    Hi Kevin ,

     

    How to test once we have implemented the iRule ?

     

    thanks and regards Deepak MK

     

  • Jaz_170005's avatar
    Jaz_170005
    Icon for Nimbostratus rankNimbostratus
    Oct 05, 2015

    Hello Everyone,

     

    That iRule works, however it means that we have to add it to every VS we have (we have tons of those). is there a better solution? does F5 has a HF for it?