I have a case where a customer wants to remove the SAMEORIGIN header and add ALLOW-FROM. This is Apache 2.22
I have done this in both the http:// and https:// configurations:
Header set X-Frame-Options "ALLOW-FROM ..."
When I curl the http:// url I see only the ALLOW-FROM, not the SAMEORIGIN header. However, curling the https:// url it still adds the SAMEORIGIN header before the ALLOW-FROM. I have checked in the global apache confs and the site .htaccess and cannot find where this is being forced.
I have also tried first unsetting the headers and then setting the ALLOW-FROM in both the https:// conf and .htaccess.
Where else might I look?