Nginx " X-Frame-Options" set to two values

Question

I added this to my config: add_header X-Frame-Options "ALLOW-FROM http://167.235.117.189" always;. But Chrome says that there are two "X-Frame-Options" set. I searched with grep in my entire /etc/nginx directory but it only found the one I set. Can anybody help me?

Answer 1

I added this: fastcgi_hide_header X-Frame-Options; to my route config

Answer 2

Different browser may treat this differently. ALLOW-FROM has limited support outside IE. I would suggest to use the Content-Security-Policy header instead. Set the value to "frame-ancestors 'self' 167.235.117.189" if your current X-Frame-Options values are SAMEORIGIN and the ip. When the frame-ancestors directive is present X-Frame-Options will be ignored and you can allow both sources.