We are needing to turn on security headers for ASM response and blocking pages. There is a KB (K25232031 ) that mentions it being enabled by default for version 16.0.0.
We are running a prior version. Does anyone know if this is possible on earlier versions?
You can add response headers from the "Response and Blocking Pages" settings.
Security > Application Security > Security Policies > Policies List > waf_policy_name > Response and Blocking Pages > Custom Response
K25232031 is interesting, thanks for the link.
Adding a simple Content-Security-Policy will be the better way. I do not tested it, but this shoud suffice:
Content-Security-Policy: default-src 'self'; frame-ancestors 'self'
P.S.: I always change the Response Code to 403