Forum Discussion

Cirrostratus

Jun 16, 2023

Removing x-frame-options header from response when using APM

Hey everyone!

We have an application that uses iframe to load another site that´s apm protected, but the default x-frame-options deny blocks this. Anyone have any ideas on how to bypass this (withouth globally disabling this feature)?

I´ve tried several irules at different events to remove the header, but without any progress..

application delivery

BIG-IP Access Policy Manager (APM)

This should do the trick.

when CLIENT_ACCEPTED {
    ACCESS::restrict_irule_events disable
}

when HTTP_RESPONSE_RELEASE {
    HTTP::header remove "x-frame-options"
}

Juergen_Mang
Jun 21, 2023
The apm policy fires always if it is attached to the vs, unless you add an ACCESS::disable anywhere.

Why ACCESS::restrict_irule_events is required: https://clouddocs.f5.com/api/irules/ACCESS__restrict_irule_events.html

Juergen_Mang
MVP
Jun 19, 2023
This should do the trick.

when CLIENT_ACCEPTED { ACCESS::restrict_irule_events disable } when HTTP_RESPONSE_RELEASE { HTTP::header remove "x-frame-options" }
- kimhenriksen
  Cirrostratus
  Jun 19, 2023
  Will give it a try, just have to wait for the user to test again 🙂
- kimhenriksen
  Cirrostratus
  Jun 20, 2023
  That´s a negative on that, your irule was almost identical to mine .. except for the first event. But what i added that, the apm policy doesnt fire at all... When i access the vip there is nothing.
  - Juergen_Mang
    MVP
    Jun 21, 2023
    The apm policy fires always if it is attached to the vs, unless you add an ACCESS::disable anywhere.
    
    Why ACCESS::restrict_irule_events is required: https://clouddocs.f5.com/api/irules/ACCESS__restrict_irule_events.html

Forum Discussion

Removing x-frame-options header from response when using APM

Recent Discussions

ASM Sync Between 2 Data Centers

Problems connecting to vpn after upgrading to ubuntu 24.04

F5 Hotfix

Bypass "Bad unescape" in Body POST (ASM, POST, JSON)

URL redirect

Related Content

Clickjacking Protection Using X-FRAME-OPTIONS Available for Firefox

Set x-frames-options header values depending on URI

Introduction of Incident Response

Remove X- Headers From Web Server Response

custom response page for api