title: Setting/Override x-frame-option for only for a specific page on Magento 2.1
body: <p>Magento 2.1 set X-Frame-Option header for all frontend pages as SAMEORIGIN. it allow us to change it on app/etc/env.php configuration but it will change for all pages on the frontend.</p>
  
  <p>On my case I want to change it for a specific page. Setting this on the controller doesn't work because Magento overrides it later in a Plugin call.</p>
  
  <p>I've managed to achieve this using Plugin the same way Varnish Module sets its headers.</p>
  
  <p>But, since I want to allow it for just one page I am not happy with this approach since it is adding some overhead on every response on frontend. It may be the proper Magento way of doing it but I am new with Magento so I am not sure.</p>
  
  <p>I am not doing much on there which will not have a huge impact on the requests since I am not using DB or anything for the other pages. but I would like to know if someone has found a better approach for that.</p>
  
  <pre><code>&lt;?php
  namespace Nei\MyModule\Plugin;
  use Nei\MyModule\Model\Config;
  use Magento\Framework\App\PageCache\NotCacheableInterface;
  use Magento\Framework\App\RequestInterface;
  use Magento\Framework\App\Response\Http;
  /**
   * HTTP response plugin for frontend.
   */
  class AllowOriginHeaderForTrackingPlugin
  {
      /**
       * @var Config
       */
      private $config;
      /**
       * @var RequestInterface
       */
      private $request;
      public function __construct(
          Config $config,
          RequestInterface $request
      ) {
          $this-&gt;config = $config;
          $this-&gt;request = $request;
      }
      /**
       * Magento by default override X-Frame-Option header after Dispatcher.
       * So setting this header on controller will be overridden
       *
       * With this Plugin we override Magento's override for X-Frame-Option
       *
       * @param Http $subject
       * @return void
       */
      public function beforeSendResponse(Http $subject)
      {
          if ($subject instanceof NotCacheableInterface) {
              return;
          }
          // Only for tracking action
          $frontName = strtolower($this-&gt;request-&gt;getFrontName());
          $actionName = strtolower($this-&gt;request-&gt;getActionName());
  
          // @TODO: update the frontend and action name here
          if ($frontName === 'something' &amp;&amp; $actionName === 'anything') {
              $xFrameOption = $this-&gt;config-&gt;getXFrameOption();
              if (!empty($xFrameOption) &amp;&amp; $this-&gt;config-&gt;isTrackingEnabled()) {
                  $subject-&gt;setXFrameOptions('ALLOW-FROM '.$xFrameOption);
              }
          }
      }
  }
  </code></pre>
  
  <p>Then I register my Plugin using di.yml</p>
  
  <pre><code>&lt;!-- Nei_MyModule/etc/frontend/di.xml --&gt;
  &lt;?xml version="1.0"?&gt;
  &lt;config xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:noNamespaceSchemaLocation="urn:magento:framework:ObjectManager/etc/config.xsd"&gt;
    &lt;type name="Magento\Framework\App\Response\Http"&gt;
          &lt;plugin name="nei-mymodule-allow-origin" type="Nei\MyModule\Plugin\AllowOriginHeaderForTrackingPlugin"/&gt;
    &lt;/type&gt;
  &lt;/config&gt;
  </code></pre>