To help prevent against click-jacking, I had applied the following to my Apache 2.2 configuration based on the suggestions described in OWASP’s Clickjacking Defense Cheat Sheet and Mozilla Developer Network’s The X-Frame-Options response header:
Header always append X-Frame-Options SAMEORIGIN
However, my site has certain pages that are included in an iframe on another site, for the purpose of displaying content on digital signage devices. After I added that header, those pages would no longer load in an iframe on the digital signage devices’ browsers.
I thought I might be able to change SAMEORIGIN to ALLOW-FROM and list both the URI of my site and the URI of the digital signage page. However, the HTTP Header Field X-Frame-Options RFC indicates:
Wildcards or lists to declare multiple domains in one ALLOW-FROM statement are not permitted
The pages I wanted to exempt from the X-Frame-Options restriction exist in their own directory, /digitalsignage, so I tried to override the X-Frame-Options header in a .htaccess file:
Header always append X-Frame-Options ALLOW-ACCESS http://example.com
That caused a 500 Server Error. This message appeared in the error logs:
.htaccess: error: envclause should be in the form env=envar
The Header directive must be malformed, but I’m am not sure how. I did not determine how to properly format the statement so as not to produce that error, although several sites have pointed out that some browsers (Chrome, Safari) do not support ALLOW-ACCESS.
I changed the .htaccess file back to SAMEORIGIN, to match what was in the main site configuration:
Header always append X-Frame-Options SAMEORIGIN
I then noted that the response header sent by the server included SAMEORIGIN twice:
Header: SAMEORIGIN, SAMEORIGIN
That’s the expected behavior when using append. It appeared only once after I changed append to set:
Header always set X-Frame-Options SAMEORIGIN
I tried using set instead of append with ALLOW-ACCESS:
Header always set X-Frame-Options ALLOW-ACCESS http://example.com
But it still produced the same 500 Server Error.
After reading the documentation for Apache’s mod_headers, I realized that unset would allow me to remove the X-Frame-Options header from the /digitalsignage directory:
Header always unset X-Frame-Options
That worked, and the pages were successfully included as iframes in a page on the digital signage company’s site.