How to Add X-Frame-Options in Response Headers for Azure App service(linux)

Question

We are using Angular with Node which is hosted on Azure App service(Linux) -> Communicates with Azure Functions(API's) built using Python which is hosted on Azure Function App

We need to Pass the HTTP Headers in Response As part of resolving Clickjacking attacks vulnerability scan issue

Can anyone please explain -> How and where we need to include the 'X-Frame-Options' to 'DENY'

Answer 1

@SG Azure Thanks for reaching out to Microsoft Q&A, apologize for any inconvenience caused on this.

Based on the shared information I understand that you want to include the header X-Frame-Options to DENY in the app service HTTP headers.

On Linux App Services, there is no ‘turn-key’ solution to customizing response headers, but there are other ways that this can be done. Either programmatically or through other products that can be used with it.

A quick way that response headers can be changed as needed is through the application itself. You can refer to this documentation on How to change the headers on Linux app service with different runtimes.

To test this out, I have followed this quick start tutorial of deploying Nodejs app with express generator and the below line in my index.js file to include the HTTP header X-Frame-Options.

Here is the sample output for your reference:

Feel free to reach back to me if you have any further questions on this.