8

I'm using Apache 2.2 and want to set the X-Frame-Options header to "deny" across most of the site. I can turn it on unconditionally using mod_headers. However, there is one CGI scripts that returns content that has to be framed, so I need to turn it off for that script. Is there a way to do this?

I'm using Debian's Apache 2.2.9.

2 Answers 2

11

Try using the SetEnvIf directive, coupled with env in your Header directive:

SetEnvIf Request_URI "/MyCGI" is_cgi
Header set X-Frame-Options some-value env=!is_cgi

(or something close to that :-))

8

You can use the Location directive.

<Location /url/fragment/to/my/cgi/script>
  Header unset X-Frame-Options
</Location> 
2
  • I want "set header for everything EXCEPT this one CGI." I think your code does "set header for JUST this one CGI"?
    – user9876
    Feb 3, 2010 at 12:50
  • user9876, Sorry for the misunderstanding, I have updated the question Feb 3, 2010 at 14:45

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .