Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I'm using Apache 2.2 and want to set the X-Frame-Options header to "deny" across most of the site. I can turn it on unconditionally using mod_headers. However, there is one CGI scripts that returns content that has to be framed, so I need to turn it off for that script. Is there a way to do this?

I'm using Debian's Apache 2.2.9.

share|improve this question
add comment

2 Answers

up vote 3 down vote accepted

Try using the SetEnvIf directive, coupled with env in your Header directive:

SetEnvIf Request_URI "/MyCGI" is_cgi
Header set X-Frame-Options some-value env=!is_cgi

(or something close to that :-))

share|improve this answer
add comment

You can use the Location directive.

<Location /url/fragment/to/my/cgi/script>
  Header unset X-Frame-Options
</Location> 
share|improve this answer
    
I want "set header for everything EXCEPT this one CGI." I think your code does "set header for JUST this one CGI"? –  user9876 Feb 3 '10 at 12:50
    
user9876, Sorry for the misunderstanding, I have updated the question –  Rory Feb 3 '10 at 14:45
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.