Forum Discussion

visual2008_3086's avatar
visual2008_3086
Icon for Nimbostratus rankNimbostratus
Oct 17, 2017

HTTP header X-XSS-Protection, X-Content-Type-Options issue

I am trying to insert the HTTP header X-XSS-Protection, X-Content-Type-Options in order to mitigate a security vunerability. I have found an irule solution, but when I implemented the solution, a code error appears.Can anyone share the correct syntax for this please? when HTTP_RESPONSE {

 

if { !([ HTTP::header exists "X-Content-Type-Options“ ])} { HTTP::header insert "X-Content-Type-Options" "'nosniff'" }

 

if { !([ HTTP::header exists "X-XSS-Protection“ ])} { HTTP::header insert "X-XSS-Protection" "1; mode=block" } }

01070151:3: Rule [/OHSBC/Ohsbc] error: /OHSBC/Ohsbc:17: error: [parse error: PARSE missingQuote 515 {missing "}][{ !([ HTTP::header exists "X-Content-Type-Options“ ])}] /OHSBC/Ohsbc:18: error: [parse error: PARSE missingQuote 645 {missing "}][{ !([ HTTP::header exists "X-XSS-Protection“ ])}]

 

BIG-IP
iRules
security
  • Lee_Sutcliffe's avatar
    Lee_Sutcliffe
    Icon for Nacreous rankNacreous
    Oct 17, 2017

    You had an incorrect quotation mark at the end of your header type in the IF statement. This was preventing the close braces from working correctly.

     

    I've corrected the code:

     

    when HTTP_RESPONSE { 
    if {!([HTTP::header exists "X-Content-Type-Options" ])} { 
        HTTP::header insert "X-Content-Type-Options" "'nosniff'"
    }

    if {!([ HTTP::header exists "X-XSS-Protection"])} { 
        HTTP::header insert "X-XSS-Protection" "1; mode=block" 
    } 
}
  • Jad_Tabbara__J1's avatar
    Jad_Tabbara__J1
    Icon for Cirrostratus rankCirrostratus
    Oct 17, 2017

    Hey

    I've only corrected you syntax 

    when HTTP_RESPONSE {

if { ! [HTTP::header exists "X-Content-Type-Options"] } { 
    HTTP::header insert "X-Content-Type-Options" "'nosniff'" 
}

if { ! [HTTP::header exists "X-XSS-Protection"] } { 
    HTTP::header insert "X-XSS-Protection" "1; mode=block" 
    } 
}

    Now you should be able to create it.

    Please give me a feedback

    Regards

  • Fjordan's avatar
    Fjordan
    Icon for Nimbostratus rankNimbostratus
    May 16, 2019

    How can we verify that the iRule for XSS protection works? is there a command to verify the iRule works or a way to test it ?