web/src/main/java/org/springframework/security/web/header/writers/frameoptions/XFrameOptionsHeaderWriter.java
public void writeHeaders(HttpServletRequest request, HttpServletResponse response) {
		if (XFrameOptionsMode.ALLOW_FROM.equals(frameOptionsMode)) {
			String allowFromValue = this.allowFromStrategy.getAllowFromValue(request);
			if (XFrameOptionsMode.DENY.getMode().equals(allowFromValue)) {
				if (!response.containsHeader(XFRAME_OPTIONS_HEADER)) {
					response.setHeader(XFRAME_OPTIONS_HEADER, XFrameOptionsMode.DENY.getMode());
				}
			} else if (allowFromValue != null) {
				if (!response.containsHeader(XFRAME_OPTIONS_HEADER)) {
					response.setHeader(XFRAME_OPTIONS_HEADER,
							XFrameOptionsMode.ALLOW_FROM.getMode() + " " + allowFromValue);
				}
			}
		}
		else {
			response.setHeader(XFRAME_OPTIONS_HEADER, frameOptionsMode.getMode());
		}
	}
public void writeHeaders(HttpServletRequest request, HttpServletResponse response) {
		if (XFrameOptionsMode.ALLOW_FROM.equals(frameOptionsMode)) {
			String allowFromValue = this.allowFromStrategy.getAllowFromValue(request);
			if (XFrameOptionsMode.DENY.getMode().equals(allowFromValue)) {
				if (!response.containsHeader(XFRAME_OPTIONS_HEADER)) {
					response.setHeader(XFRAME_OPTIONS_HEADER, XFrameOptionsMode.DENY.getMode());
				}
			} else if (allowFromValue != null) {
				if (!response.containsHeader(XFRAME_OPTIONS_HEADER)) {
					response.setHeader(XFRAME_OPTIONS_HEADER,
							XFrameOptionsMode.ALLOW_FROM.getMode() + " " + allowFromValue);
				}
			}
		}
		else {
			response.setHeader(XFRAME_OPTIONS_HEADER, frameOptionsMode.getMode());
		}
	}
Writes the X-Frame-Options header value, overwritting any previous value.

@param request the servlet request
@param response the servlet response