For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

Rabbit23_116296's avatar
Rabbit23_116296
Icon for Nimbostratus rankNimbostratus
Jan 28, 2016

x-frame-options settings not working in APM

I have /my.policy overwriting every attempt I've made to disable this clickjacking protection. I have a frame that needs to access APM and this damn header is constantly getting set. Using BIGIP 12, ...
BIG-IP Access Policy Manager (APM)
devops
iRules
Kai_Wilke's avatar
Kai_Wilke
Icon for MVP rankMVP
Jan 28, 2016

Hi Rabbit,

you may try to use...

 

when HTTP_RESPONSE_RELEASE {
    log local0.notice "removing header"
    HTTP::header remove X-Frame-Options
}

 

... HTTP_RESPONSE_RELEASE is the very last event before sending the response to the client.

Cheers, Kai