X-Frame-Options with deny does not block iframe

gongya · ‎24-Nov-2021

I have an iRule as follows:

when HTTP_RESPONSE {

if {!([HTTP::header exists "X-Frame-Options"])} {

HTTP::header insert X-Frame-Options "DENY"

}

I expected the following page was blocked.

<html>

<body>

</body>

</html>

But it was not blocked.

What did I miss here ?

thanks !!

gongya · ‎24-Nov-2021

After more reading, it seems the x-frame-options prevents the page in my server from being loaded by someone else, right ?

If I loaded another page in the same server within iframe, the page should be loaded ?

When I tested it, the page was still loaded within <iframe> page </iframe>. Is this supposed to be?

gongya · ‎24-Nov-2021

How can I test a page blocked by x-frame-options DENY ?

gongya · ‎24-Nov-2021

I figured it out. thanks !!

DevCentral