Geekflare is supported by our audience. We may earn affiliate commissions from buying links on this site.
Share on:

F5 irule to Protect Clickjacking Attack using X-FRAME-OPTIONS

Invicti Web Application Security Scanner – the only solution that delivers automatic verification of vulnerabilities with Proof-Based Scanning™.

Secure Clickjacking Attack with X-Frame-Options using F5 iRule

There are multiple ways to add X-Frame-Options header in your web applications. However, implementing through F5 load balancer is probably the easiest one.

By doing at a network edge using F5 iRule give you the advantage of making changes no fly.

That’s right; you don’t need to restart any services hence no downtime.

There are three settings for X-Frame-Options:

  • SAMEORIGIN: This configuration will allow the page to be displayed in a frame on the same origin as the page itself.
  • DENY: This setting will prevent a page displaying in a frame or iframe.
  • ALLOW-FROM uri: allow resources to load only on the specified origin.

To implement in F5 irule

  • Create irule with following
when HTTP_RESPONSE {
HTTP::header insert "X-FRAME-OPTIONS" "SAMEORIGIN"
}
  • Associate this irule to respective Virtual server

To verify

Use browser’s inbuilt developer tools to examine the response headers or online using HTTP Header checker tool.

You see it’s three-line which does the job!

Thanks to our Sponsors
More great readings on Security
Power Your Business
Some of the tools and services to help your business grow.
  • Invicti uses the Proof-Based Scanning™ to automatically verify the identified vulnerabilities and generate actionable results within just hours.
    Try Invicti
  • Web scraping, residential proxy, proxy manager, web unlocker, search engine crawler, and all you need to collect web data.
    Try Brightdata
  • Semrush is an all-in-one digital marketing solution with more than 50 tools in SEO, social media, and content marketing.
    Try Semrush
  • Intruder is an online vulnerability scanner that finds cyber security weaknesses in your infrastructure, to avoid costly data breaches.
    Try Intruder