So, i'm already added X-Frame-Options in nginx config below :
location /api/ {
proxy_pass http://127.0.0.1:8181/secure/;
add_header X-Frame-Options "DENY";
}
but when i check from header response in network, the X-Frame-Options not showing at all.
if customed the random header key, like
X-Frame-Optionszzz "DEN开发者_C百科Y";
The header response showing correctly as the key and value.
Why nginx look like blocking my X-Frame-Options header?
Why do you want to set X-Frame-Options? When frame-ancestors is set in your Content-Security-Policy all modern browsers will ignore X-Frame-Options anyway. This could be the reason why nginx removes the header and doesn't remove custom headers.
精彩评论