Forum Discussion

Zach_C_355943's avatar
Zach_C_355943
Icon for Nimbostratus rankNimbostratus
Mar 16, 2018

Issues with X-XSS Protection HTTP Header

Hey folks, we recently implemented some HTTP headers onto our F5 irules and recently noticed that one of them (X-XSS-Protection) isn't showing up. At the moment, we have them in place in our irule ...
  • Zach_C_355943's avatar
    Apr 25, 2018

    Following up! Turns out the answer is we needed to have these headers under "HTTP_RESPONSE" (not REQUEST). What it looks like in a working state in our irules:

    when HTTP_RESPONSE {
      HTML Headers for PCI failures
     if { !([HTTP::header exists "X-Frame-Options"])} { HTTP::header insert "X-Frame-Options" "SAMEORIGIN" }
     if { !([HTTP::header exists "X-XSS-Protection"])} { HTTP::header insert "X-XSS-Protection" "1; mode=block" }
     if { !([HTTP::header exists "X-Content-Type-Options"])} { HTTP::header insert "X-Content-Type-Options" "'nosniff'" }
    }