I have a case where a customer wants to remove the SAMEORIGIN header and add ALLOW-FROM. This is Apache 2.22

I have done this in both the http:// and https:// configurations:

Header set X-Frame-Options "ALLOW-FROM ..."

When I curl the http:// url I see only the ALLOW-FROM, not the SAMEORIGIN header. However, curling the https:// url it still adds the SAMEORIGIN header before the ALLOW-FROM. I have checked in the global apache confs and the site .htaccess and cannot find where this is being forced.

I have also tried first unsetting the headers and then setting the ALLOW-FROM in both the https:// conf and .htaccess.

Where else might I look?


Figured it out. There are some php configuration files buried within the site code that are forcing sameorigin.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.