app/controllers/application_controller.rb
# Prevent CSRF attacks by raising an exception.
# For APIs, you may want to use :null_session instead.
Prevent CSRF attacks by raising an exception.
For APIs, you may want to use :null_session instead.
Prevent CSRF attacks by raising an exception . For APIs you may want to use : null_session instead .
def allow_iframe 
      response.headers.except! 'X-Frame-Options'
    end
def allow_iframe response . headers . except! 'X-Frame-Options' end
Prevent CSRF attacks by raising an exception.
Prevent CSRF attacks by raising an exception .
#response.headers["X-FRAME-OPTIONS"] = "ALLOW-FROM #{Settings.parent_frame}" #response.headers["Content-Security-Policy"] = "frame-ancestors  #{Settings.parent_frame}" #response.headers["X-FRAME-OPTIONS"] = "GOFORIT"