Home / server / Questions / 184912
Accepted
Manoj Govindan
Asked: 2010-09-27 23:10:29 +0800 CST

How can I add X-Frame-Options selectively using Apache?

  • 772

I am planning to set X-Frame-Options SAMEORIGIN in my server's httpd.conf as part of improving the defenses against click jacking. I understand this will add the X-Frame-Options header to all pages. There is a "widget" page that I would like to exempt from this (other sites will display this page inside an IFRAME).

Is there a way to configure Apache 2 to not send the header for a specific page alone?

apache-2.2 x-frame-options

2 Answers

  1. Best Answer

    Yes, use SetEnvIf:

    SetEnvIf Request_URI "^/my_awesome_widget_page.html$" iframes_are_cool
Header set X-Frame-Options SAMEORIGIN env=!iframes_are_cool
    • 3

  2. You can unset the X-Frame-Options header in a .htaccess file (assuming your widget is in its own subdirectory):

    Header always unset X-Frame-Options
    • 0