4

My Django site uses django-summernote in iframes, and is throwing this error:

Multiple 'X-Frame-Options' headers with conflicting values ('SAMEORIGIN, DENY') encountered when loading 'http://example.com/summernote/editor/id_comment_text/'. Falling back to 'DENY'.

I can't figure out where the DENY is coming from.

In my Django project settings I have:

MIDDLEWARE_CLASSES = (
    ...
    'django.middleware.clickjacking.XFrameOptionsMiddleware',
    ...
)

which: "By default, the middleware will set the X-Frame-Options header to SAMEORIGIN for every outgoing HttpResponse."

I also added this in my nginx.conf (from here):

add_header X-Frame-Options SAMEORIGIN;

Other possibly relevant info: The problem arose when I upgraded my server from Ubuntu 14.04 to 16.04, and by project's virtual environment from Python 3.4 to Python 3.5. The version of Django and django-summernote are still the same.

How do I find the source of this DENY setting?

43Tesseracts
  • 4,617
  • 8
  • 48
  • 94
  • I'm running into the same issue, @43Tesseracts - did you ever figure out what was going on? – Brian E. Langston Dec 27 '16 at 18:41
  • Yes! nginx was using multiple conf files. I was only looking at my custom nginx.conf file, but this was being over rode by another conf file. Sorry I don't remember the specifics and don't have access to the server at the moment. – 43Tesseracts Dec 27 '16 at 20:07
  • If this happens, one must look inside all the relevant nginx config files and check all the add_headers. – Flux Mar 07 '17 at 09:54

1 Answers1

8

In my case the issue was in the file: /etc/nginx/snippets/ssl-params.conf

Just had to comment out: add_header X-Frame-Options DENY;

Anonymous
  • 81
  • 1
  • 2