Question 339683 in Nginx Question posted in
The official documentation can be found here.

Nginx " X-Frame-Options" set to two values

I added this to my config:
add_header X-Frame-Options "ALLOW-FROM http://167.235.117.189" always;. But Chrome says that there are two "X-Frame-Options" set. I searched with grep in my entire /etc/nginx directory but it only found the one I set. Can anybody help me?

Tags:

2

Answers


  1. Chosen as BEST ANSWER
    0

    I added this: fastcgi_hide_header X-Frame-Options; to my route config


  2. 0

    Different browser may treat this differently. ALLOW-FROM has limited support outside IE. I would suggest to use the Content-Security-Policy header instead. Set the value to "frame-ancestors ‘self’ 167.235.117.189" if your current X-Frame-Options values are SAMEORIGIN and the ip. When the frame-ancestors directive is present X-Frame-Options will be ignored and you can allow both sources.

    Login or Signup to reply.
Please signup or login to give your own answer.

Back To Top
Search