Override HTTP header's default settings (X-FRAME-OPTIONS)

Question

I'm working with the dev version of Laravel (4.1.*) and there is a new default configuration that I don't want : X-Frame-Options: SAMEORIGIN

For the moment I disable it by deleting one line in Illuminate\Http\FrameGuard.php

I'm looking for a better solution. I've try in the filtre.php file :

App::after(function($request, $response) {
   $response->header('X-Frame-Options', 'ALLOW-ALL');
});

But it just adds the option (X-Frame-Options:ALLOW-ALL, SAMEORIGIN), whereas I need an override.

Jung

Anyone arriving here using laravel 4.2 and wanting to limit X-Frame-Options header back to the 'old' behaviour (pre-4.2): edit app/filters.php and add the following line in the App::after() filter: $response->headers->set('X-Frame-Options', 'SAMEORIGIN', true); – Tetragon

Answer 1

Laravel doesn't provide any configuration to disable this functionality.

According to Taylor Otwell, the only way to bypass it is by adding the following line into the start file:

App::forgetMiddleware('Illuminate\Http\FrameGuard');

The dirty solution is to comment the guilty line:

$response->headers->set('X-Frame-Options', 'SAMEORIGIN', false);

---

Edit (Jan 29th 2014): new info from Taylor Otwell on GitHub about next Laravel's policy.

Removing this by default in 4.2. Should be in an after filter - will leave FrameGuard class so people can add the middleware manually if they want.

Jung

Good to have it here also :) Here is detailed topic also: forumsarchive.laravel.io/viewtopic.php?pid=64869 – Pym

so is this App::forgetMiddleware('Illuminate\Http\FrameGuard'); still useful in 4.2 ? – Vertex

@ngakak I didn't test Laravel 4 yet, but as far as I understand Taylor Otwell's words, is that Laravel 4 will have no X-FRAME-OPTIONS value defined In default header anymore. Do you have a X-FRAME-OPTIONS problem? – Jung

Is there also a solution for laravel 5? – Jewess

Is there a solution is 5.3 as I am having this issue now and cant find any info on it besides the above. – Lagasse

Any idea to do it with php cURL? – Rasia

Answer 2

The third parameter of the header method should serve your needs.

Tamarah

It should work except if the FrameGuard file is called at the end of the application, and it's the case. I found an issue request on Github about this problem. – Jung