title: Nginx X-Frame-Options
body: <p>i use nginx 1.8.0 under centOS 6.7 which serving Ruby On Rails 4.2.3 application.</p>
  
  <p><strong>The Problem:</strong></p>
  
  <p>I need to enable iframe options for all domains so tried this:</p>
  
  <pre><code>X-Frame-Options: *
  </code></pre>
  
  <p>then when i check headers i see it twice 1 time with <code>SAMEORIGIN</code> and one time with <code>*</code>, here is the response:</p>
  
  <pre><code>HTTP/1.1 200 OK
  Server: nginx/1.8.0
  Date: Sun, 01 Nov 2015 15:48:32 GMT
  Content-Type: text/html; charset=utf-8
  Connection: keep-alive
  Status: 200 OK
  Strict-Transport-Security: max-age=31536000
  X-Frame-Options: SAMEORIGIN
  X-XSS-Protection: 1; mode=block
  X-Content-Type-Options: nosniff
  ETag: W/"d14b3de05fb18ebe4a94774c8f209e7f"
  Cache-Control: max-age=0, private, must-revalidate
  Set-Cookie: guess_locale=en; path=/; secure
  Set-Cookie: _admin_numgames_com_session=Y3N0QjR2NXY0VFlZMlVnMHJLZC9WbUVraldZYjhpeHo0UG41akpaZE1rb0tQWS9YeGpkcklTRmViUU5aVmJpUElCcWpMaFJWQmpIWHRSazI4TE9QdTgvQ2VVRGYrSW9VcjA4eWVCMVlsUHJRejR1WmNoQWZoL2hGeVA1ZHp5YWxPdFZ4S25ydEtTamVnbFlZMEhJRDdXalQ2MU93T24vWnR6b28wM0NvYS82Nm1XMGV2Njh4djIzR1RNb2w3WTVHUDM3cVl3NnVrQnJ1WTMyU3I4dVBjY3RORWRQSlk2VmhNVnRVelZRbHRVWT0tLU9DYVBIZUxoUXlLN2VmZ01VNEhab3c9PQ%3D%3D--fa2a9d6817b5464b82a2babd784ed098f2526eeb; path=/; secure; HttpOnly
  X-Request-Id: 4762503a-a9a8-41ce-b1a7-26269b7e9184
  X-Runtime: 0.963198
  X-Frame-Options: *
  </code></pre>
  
  <p>there is only 1 time declare this option so why i see it twice? and how do i remove this option so any one will be able to use my domain with iFrame?</p>