Secure Clickjacking Attack with X-Frame-Options using F5 iRule

There are multiple ways to add X-Frame-Options header in your web applications. However, implementing through F5 load balancer is probably the easiest one.

By doing at a network edge using F5 iRule give you the advantage of making changes no fly.

That’s right; you don’t need to restart any services hence no downtime.

There are three settings for X-Frame-Options:

  • SAMEORIGIN: This configuration will allow the page to be displayed in a frame on the same origin as the page itself.
  • DENY: This setting will prevent a page displaying in a frame or iframe.
  • ALLOW-FROM uri: allow resources to load only on the specified origin.

To implement in F5 irule

  • Create irule with following
when HTTP_RESPONSE {
HTTP::header insert "X-FRAME-OPTIONS" "SAMEORIGIN"
}
  • Associate this irule to respective Virtual server

To verify

Use browser’s inbuilt developer tools to examine the response headers or online using HTTP Header checker tool.

You see it’s three-line which does the job!