x-frame-options settings not working in APM

I personally prefer using of Content-Security-Policy and X-Content-Security-Policy, instead of X-Frame-Options.

X-Frame-Options header is not very flexible, especially if you want to allow your APM site to be rendered on more than just one site. This is the code I use, which is quite similar to Kai's and Rabbit23's code:

when CLIENT_ACCEPTED {
  ACCESS::restrict_irule_events disable
}

when HTTP_RESPONSE_RELEASE {

  set apm_csp "frame-ancestors 'self' developer.mozilla.org *.f5.com"

   X-Frame-Options, Content-Security-Policy, X-Content-Security-Policy
  
  HTTP::header remove X-Frame-Options
  HTTP::header remove Content-Security-Policy
  HTTP::header remove X-Content-Security-Policy

  HTTP::header insert Content-Security-Policy "$apm_csp"
  HTTP::header insert X-Content-Security-Policy "$apm_csp"
}

<p>In the example above your APM site will be allowed to be rendered inside an <code><iframe></code> on the site's own origin (this excludes subdomains), <code>developer.mozilla.org</code> and all <code>f5.com</code> subdomains.</p> <p>I really wish F5 stopped using <code>X-Frame-Options</code> and started using <code>Content-Security-Policy</code> and <code>X-Content-Security-Policy</code> instead.</p>