X-Frame-Options - remove deny, set sameorigin

[darioapis]

Hi, my problem is explained in the heading. I need to remove X-Frame-Options: deny from the HTTP header and change it to sameorigin. Possible it is in web.conf. Any help is advisable.

[chrisyounger · Accepted solution]

You can't set it to sameorigin. You can only remove the header all together as you have seen by changing web.conf and setting x_frame_options_sameorigin = false. This will mean you can then embed Splunk in a frame if you want.

If it is important that you set the header to be sameorigin then you would need to use something like a nginx proxy over the top of Splunk. (fairly easy to do)