title: X-Frame DENY in Spring security
body: <p>I'm using <a href="http://johnculviner.com/jquery-file-download-plugin-for-ajax-like-feature-rich-file-downloads/" rel="nofollow noreferrer">jquery download plugin</a> in my spring project but browser give me the following error:</p>
  
  <pre><code>Refused to display 'http://localhost:8086/DART/fleetAndCar/download/5' in a frame because it set 'X-Frame-Options' to 'DENY'.
  </code></pre>
  
  <p>I read is a problem about Xframe in spring security so I have added </p>
  
  <pre><code>http
      .headers()
        .addHeaderWriter(new XFrameOptionsHeaderWriter(XFrameOptionsHeaderWriter.XFrameOptionsMode.SAMEORIGIN))
  </code></pre>
  
  <p>but it doesn't change DENY but add even SAMEORIGIN so I have he following error:</p>
  
  <pre><code>Multiple 'X-Frame-Options' headers with conflicting values ('DENY, SAMEORIGIN') encountered when loading 'http://localhost:8086/DART/fleetAndCar/download/5'. Falling back to 'DENY'.
  </code></pre>
  
  <p>and this is the http request:</p>
  
  <p><a href="https://i.stack.imgur.com/fwOoh.jpg" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/fwOoh.jpg" alt="enter image description here"></a></p>
  
  <p>this is my spring configuration:</p>
  
  <pre><code>@Configuration
      @Order(1)
      public static class ApiWebSecurityConfig extends WebSecurityConfigurerAdapter{
          @Override
          protected void configure(HttpSecurity http) throws Exception {
              http.csrf().disable()
              .antMatcher("/client/**")
              .authorizeRequests()
              //Exclude send file from authentication because it doesn't work with spring authentication
              .antMatchers(HttpMethod.POST, "/client/file").permitAll()
              .anyRequest().authenticated()
              .and()
              .httpBasic();
          }
      }
  
      @Configuration
      @Order(2)
      public static class FormWebSecurityConfig extends WebSecurityConfigurerAdapter{
  
          @Autowired
          RoleServices roleServices;
  
          @Override
          public void configure(WebSecurity web) throws Exception {
              web
              //Spring Security ignores request to static resources such as CSS or JS files.
              .ignoring()
              .antMatchers("/static/**");
          }
  
          @Override
          protected void configure(HttpSecurity http) throws Exception {         
              List&lt;Role&gt; roles=roleServices.getRoles();
              //Retrieve array of roles(only string field without id)
              String[] rolesArray = new String[roles.size()];
              int i=0;
              for (Role role:roles){
                  rolesArray[i++] = role.getRole();
              }
  
              http
              .headers()
                 .addHeaderWriter(new XFrameOptionsHeaderWriter(XFrameOptionsHeaderWriter.XFrameOptionsMode.SAMEORIGIN))
                 .and()
              .authorizeRequests() //Authorize Request Configuration
              .anyRequest().hasAnyRole(rolesArray)//.authenticated()
              .and() //Login Form configuration for all others
              .formLogin()
              .loginPage("/login")
              .permitAll()
              .and()
              .exceptionHandling().accessDeniedPage("/403")
              .and()
              .logout()
              .logoutSuccessUrl("/login?logout")
              .permitAll();
  
          }
      }
  </code></pre>
  
  <p>How can I fix this problem?Thanks (the download works fine despite the error)</p>