Clojurians Log v2

I’m having trouble removing X-FRAME-OPTIONS headers. Right now, the setting is set to DENY. If I update the headers in an interceptor to “SAMEORIGIN”, it gets overwritten, however I want to remove the header altogether.

There is probably a built in / default interceptor that has a :leave clause that executes after yours. Try adding an interceptor with a :leave as the very first interceptor.

e.g.,:

(update ::http/interceptors
              (fn [xs s] (into [s] xs))
              (interceptor/interceptor
                {:name :fix-xframe
                 :leave (fn [ctx]
                          ;...
                          )}))

Right I’ve done that. If I leave the X-FRAME-OPTIONS header undefined it just gets set to deny

If I set it to SAMEORIGIN, it stays as SAMEORIGIN

Hmm, maybe it is coming from Jetty (or your webserver)