- Issue created by @mdranove
- 🇺🇸United States smustgrave
So know this ticket and we ended up finding that varnish was the culprit
In Acquia hosting environments, and potentially others as well, the getHeaders() method returns $headers all in lowercase. This is opposed to other environments which returns them in sentence case. This is causing the "All specified headers present check" to fail even when the headers are present.
1. Have an Acquia hosted site.
2. Verify that X-Frame-Options header is present and set to SAMEORIGIN
3. Run the security review check.
4. The check fails.
Make the check case-insensitive.
Active
3.1
Code
So know this ticket and we ended up finding that varnish was the culprit