Removing x-frame-options header from response when using APM

[kimhenriksen]

Hey everyone!

We have an application that uses iframe to load another site that´s apm protected, but the default x-frame-options deny blocks this. Anyone have any ideas on how to bypass this (withouth globally disabling this feature)?

I´ve tried several irules at different events to remove the header, but without any progress..

[Juergen_Mang · Accepted solution]

This should do the trick.

when CLIENT_ACCEPTED {
    ACCESS::restrict_irule_events disable
}

when HTTP_RESPONSE_RELEASE {
    HTTP::header remove "x-frame-options"
}

[Juergen_Mang · Accepted solution]

This should do the trick.

when CLIENT_ACCEPTED {
    ACCESS::restrict_irule_events disable
}

when HTTP_RESPONSE_RELEASE {
    HTTP::header remove "x-frame-options"
}

[kimhenriksen]

Will give it a try, just have to wait for the user to test again 🙂

[kimhenriksen]

That´s a negative on that, your irule was almost identical to mine .. except for the first event. But what i added that, the apm policy doesnt fire at all... When i access the vip there is nothing.

[Juergen_Mang · Accepted solution]

The apm policy fires always if it is attached to the vs, unless you add an ACCESS::disable anywhere.

Why ACCESS::restrict_irule_events is required: https://clouddocs.f5.com/api/irules/ACCESS__restrict_irule_events.html

[kimhenriksen]

Yes, we had some other issues.. and they just appeared at the same time. The first part was what i was missing, so this will not be forgotten in the future.

when CLIENT_ACCEPTED {
    ACCESS::restrict_irule_events disable
}