make x-frame-options configurable

Created on 19 January 2016, almost 9 years ago
Updated 31 January 2023, almost 2 years ago

In a project we want to embed 1 view page as iframe on another website with a different domain.
Drupal 8 sets the X-Frame-Options Header hard on response with the setting SAMEORIGIN which prevents this.

You'll find the following in FinishResponsesubscriber::onRespond
$response->headers->set('X-Frame-Options', 'SAMEORIGIN', FALSE);

Lets make the domains there configurable and fallback on SAMEORIGIN if there is no configuration.

🐛 Bug report
Status

Postponed

Version

10.1

Component
Request processing 

Last updated 3 days ago

No maintainer
Created by

🇨🇭Switzerland yobottehg Basel

Live updates comments and jobs are added and updated live.
Sign in to follow issues

Comments & Activities

Not all content is available!

It's likely this issue predates Contrib.social: some issue and comment data are missing.

Production build 0.71.5 2024