title: Apache2 Headers not working correctly
body: <p>Having issues with iframes (have no control as these come with the system I have) and the cross-site stuff.</p>
  
  <p>Have added the usual <code>X-Frame-Options</code> to my <code>.htaccess</code> file to include the directive to allow it to allow the iframe from this other system that wants to iframe the site. No problem at first.  </p>
  
  <blockquote>
    <p>&lt;IfModule mod_headers.c&gt;<br />
    Header always set X-Frame-Options "ALLOW-FROM <a href="https://otherhost" rel="nofollow">https://otherhost</a>" <br />
    &lt;/IfModule&gt;</p>
  </blockquote>
  
  <p>And I can confirm that the above is taking effect as I have messed with the header content and it is reflected.</p>
  
  <p>For some reason, I keep seeing the header <code>X-Frame-Options ALLOW-FROM https://otherhost, SAMEORIGIN</code> with this additional <code>SAMEORIGIN</code>, which of course is not valid and fails within the browsers, ultimately resulting in the browser falling back to <code>DENY</code>, which then means the iframe is not shown.</p>
  
  <p>The apache2 specs states for the <code>set</code> option, that; </p>
  
  <blockquote>
    <p>The response header is set, replacing any previous header with this name. The value may be a format string.</p>
  </blockquote>
  
  <p>Yet I do not see it replacing the string.  If I <code>curl</code> the login page, it presents correctly, if I inspect it in the chrome/safari inspector, it shows the additional <code>, SAMEORIGIN</code> and then complains that it's not valid.</p>
  
  <p>I've even tried using the <code>unset</code> option for the <code>Header</code> directive, but it still keeps producing this header.</p>
  
  <p><strong>Is the <code>Header</code> directive post or pre output?</strong> as this is driving me nuts and wasting so much time for a simple thing.</p>