Set x-frames-options header values depending on URI

[Chris_Baiocchet]

Hello,

I am trying to write an irule that sets the x-frame-options header value to SAMEORIGIN or a site, unless the URI contains a specific string. In that case I would want the x-frames-option value to be set to ALLOW. The code I have so far is show below, but the header value is always set to SAME origin when I examine headers on the client side, but I'm not sure what I'm missing:

when HTTP_REQUEST {

  if { [string tolower [HTTP::uri]] contains "/docsAPI" } {

    set insertXFrame 1

  }

  else {

    set insertXFrame 0

  }

}

when HTTP_RESPONSE {

  if {!([HTTP::header exists "X-Frame-Options" ])} {

    HTTP::header insert "X-Frame-Options" "SAMEORIGIN"

  }

  if {!([HTTP::header exists "X-XSS-Protection"])} {

    HTTP::header insert "X-XSS-Protection" "1; mode=block"

  }

  if {!([HTTP::header exists "X-Content-Type-Options"])} {

    HTTP::header insert "X-Content-Type-Options" "nosniff"

  }

  if {!([HTTP::header exists "Strict-Transport-Security"])} {

    HTTP::header insert "Strict-Transport-Security" "max-age=16070400; includeSubDomains"

  }

  if { $insert_xframe } then {

    HTTP::header insert "X-Frame-Options" "ALLOWED"

  }

}

Would appreciate any thoughts or suggestions.

Thank you.

Chris

[Enes_Afsin_Al · Accepted solution]

Hi Chris,

pay attention to use of "string tolower".

[string tolower [HTTP::uri]] contains "/docsapi"

[Chris_Baiocchet]

Of course!!!

Thank you. case sensitivity always gets me 🙂

[hedmondjohn]

X-Frame-Options is a header included in the response to the request to state if the domain requested will allow itself to be displayed within a frame. It has nothing to do with javascript or HTML, and cannot be changed by the originator of the request. You can't set X-Frame-Options on the iframe. That is a response header set by the domain from which you are requesting the resource . They have set the header to SAMEORIGIN in this case, which means that they have disallowed loading of the resource in an iframe outside of their domain. So you cannot embed their website into yours. Browsers when see that the response header contains X-Frame-Options: SAMEORIGIN, they check your domain and block the rendering of the <iframe>. It is a security measure to avoid clickjacking.