I’m running Nginx 1.4.4 on Ubuntu 12.04 and have added the
X-Frame-Options header for one of my sites but in testing it appears
that Nginx includes this itself in addition to user configured headers.
Basically I want X-Frame-Options to be DENY but when I set that header
Nginx also sends an X-Frame-Options SAMEORIGIN header so that there are
two X-Frame-Options headers in every request.
Is there some way to disable the extra header? I can’t find anything in
my configuration that would add the second header.
— Original message —
From: “Some D.” [email protected]
Date: 25 January 2014, 06:04:10
I’m running Nginx 1.4.4 on Ubuntu 12.04 and have added the X-Frame-Options
header for one of my sites but in testing it appears that Nginx includes this
itself in addition to user configured headers. Basically I want X-Frame-Options to
be DENY but when I set that header Nginx also sends an X-Frame-Options SAMEORIGIN
header so that there are two X-Frame-Options headers in every request.
Is there some way to disable the extra header? I can’t find anything in my
configuration that would add the second header.
May by this is the header, has been set by your php-application?
You can remove this with help of module
— Original message —
From: “Some D.” [email protected]
Date: 25 January 2014, 06:04:10
I’m running Nginx 1.4.4 on Ubuntu 12.04 and have added the X-Frame-Options
header for one of my sites but in testing it appears that Nginx includes this
itself in addition to user configured headers. Basically I want X-Frame-Options to
be DENY but when I set that header Nginx also sends an X-Frame-Options SAMEORIGIN
header so that there are two X-Frame-Options headers in every request.
Is there some way to disable the extra header? I can’t find anything in my
configuration that would add the second header.
May by this is the header, has been set by your php-application?
You can remove this with help of module Headers More | NGINX
I don’t actually use PHP but your response lead me to an answer.
Apparently Django sets some headers so it looks like I need to disable
it there. Thanks!
Seems a bit strange to me that an application framework sets HTTP
headers. Surely this should be left to the HTTP server? What are other
peoples opinions on this?
Seems a bit strange to me that an application framework sets HTTP headers.
Surely this should be left to the HTTP server? What are other peoples
opinions on this?
There are many instances where the application is the most
knowledgable layer regarding which HTTP headers to send: think
caching; think keep-alive. In general, the absolute /least/ you can do
in the reverse-proxy layer, the better. IMHO.
Fair enough. It would be somewhat easier to manage if all headers were
implemented in one place or the other. If I could set arbitary headers
in Django then I could do it all there but at the moment I have some
headers set in my Nginx configuration and some headers that appear to be
set in Django and that just makes it confusing.