NimbostratusHi All,
I have been asked by the business to configure X-Frame-Options Allow-From in the response header.
Quick search gave me the below iRule,
when HTTP_RESPONSE { HTTP::header insert "X-FRAME-OPTIONS" “SAMEORIGIN)”}
However, the value of the XFO is to be Allow-From.
Can anyone please look into this for an appropriate iRule.
Thanks in advance,
MSK
NacreousIt’s certainly doable but it’s a bit limiting solution for the customer. If you specify that Allow-From option, your customers will be restricted to Internet Explorer or Mozilla Firefox (Chrome, Chromium, Safari do not support Allow-From).
For public-facing applications, there are two options - use SAMEORIGIN as the value for X-Frame-Options, or do not use X-Frame-Options at all. It's a pity that developers of major web browsers do not cooperate to align standards
If you still want to go for it:
when HTTP_RESPONSE {
if { not([HTTP::header exists "X-Frame-Options"])}{
HTTP::header insert X-Frame-Options {ALLOW-FROM https://devcentral.f5.com}
} else {
HTTP::header replace X-Frame-Options {ALLOW-FROM https://devcentral.f5.com}
}
}
Have not tested for errors (please verify in QA, and check /var/log/ltm for TCL errors)
Regards,
NimbostratusNacreous
NimbostratusIt’s certainly doable but it’s a bit limiting solution for the customer. If you specify that Allow-From option, your customers will be restricted to Internet Explorer or Mozilla Firefox (Chrome, Chromium, Safari do not support Allow-From).
For public-facing applications, there are two options - use SAMEORIGIN as the value for X-Frame-Options, or do not use X-Frame-Options at all. It's a pity that developers of major web browsers do not cooperate to align standards
If you still want to go for it:
when HTTP_RESPONSE {
if { not([HTTP::header exists "X-Frame-Options"])}{
HTTP::header insert X-Frame-Options {ALLOW-FROM https://devcentral.f5.com}
} else {
HTTP::header replace X-Frame-Options {ALLOW-FROM https://devcentral.f5.com}
}
}
Have not tested for errors (please verify in QA, and check /var/log/ltm for TCL errors)
Regards,
NimbostratusNimbostratus