title: How to set X-Frame Options to ALLOW-FROM https://example.com and SAMEORIGIN on server
body: <p>I have a requirement to set the X-Frame options on the <strong>server level</strong> to either:</p>
  <blockquote>
  <ul>
  <li>X-Frame-Options: SAMEORIGIN</li>
  <li>X-Frame-Options: ALLOW-FROM <a href="https://example.com/" rel="noreferrer">https://example.com/</a></li>
  </ul>
  </blockquote>
  <p>Understand that X-Frame Options are mutually exclusive. See <a href="https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-Frame-Options" rel="noreferrer">here</a>.</p>
  <p>However, my application requires framing in <strong><a href="https://example.com" rel="noreferrer">https://example.com</a></strong> and also from its <strong>SAMEORIGIN</strong>.</p>
  <p>Please advise if there is a way around this while retainining my application's requirement to having allow framing on the <strong>same origin</strong>  and be framed on <strong>1 external site</strong>.</p>
  <p>Or is this impossible?</p>