Forum Discussion

visual2008_3086's avatar
visual2008_3086
Icon for Nimbostratus rankNimbostratus
Oct 17, 2017

HTTP header X-XSS-Protection, X-Content-Type-Options issue

I am trying to insert the HTTP header X-XSS-Protection, X-Content-Type-Options in order to mitigate a security vunerability. I have found an irule solution, but when I implemented the solution, a cod...
BIG-IP
iRules
security
Lee_Sutcliffe's avatar
Lee_Sutcliffe
Icon for Nacreous rankNacreous
Oct 17, 2017

You had an incorrect quotation mark at the end of your header type in the IF statement. This was preventing the close braces from working correctly.

 

I've corrected the code:

 

when HTTP_RESPONSE { 
    if {!([HTTP::header exists "X-Content-Type-Options" ])} { 
        HTTP::header insert "X-Content-Type-Options" "'nosniff'"
    }

    if {!([ HTTP::header exists "X-XSS-Protection"])} { 
        HTTP::header insert "X-XSS-Protection" "1; mode=block" 
    } 
}