title: Cannot override X-Frame-Options with Apache/Rails
body: <p>I'm working within Facebook (with the Koala gem) and finally have to deal with a user having changed their password.  While it may not be the best interaction, my app catches the authentication change and presents the user with a link to click to reauthorize.  Clicking the link correctly hits FB and the redirect delivers the expected auth_code.  HOWEVER, the page delivered in response to the FB redirect is returned with X-Frame-Options set to DENY with the result that the user never sees the re-authentication results.</p>
  
  <p>I'm lost as to why the X-Frame-Options are set to DENY.</p>
  
  <p>I have tried setting the X-Frame-Options to SAMEORIGIN from within the Rails (3.2.6) application by adding the following line to the action:</p>
  
  <pre><code>response.headers['X-Frame-Options'] = 'SAMEORIGIN'
  </code></pre>
  
  <p>No luck.</p>
  
  <p>I have also tried adjusting the response headers via Apache.  I have tried setting the X-Frame-Header for the entire site as well as targeting the specific urls that could be affected.  The current configuration looks like this (redacted):</p>
  
  <pre><code>&lt;VirtualHost *:443&gt;
     ServerName xx.xx.com
     DocumentRoot /apps/fb-publisher/current/public
     PassengerRuby /home/ubuntu/.rvm/wrappers/ruby-1.9.2-p290@rails3/ruby
     ... SSL config ...
     &lt;Location ~ "/publisher/(revalidate|new)"&gt;
        Header set X-Frame-Options SAMEORIGIN
     &lt;/Location&gt;
     &lt;Directory /apps/fb-publisher/current/public&gt;
        ...
     &lt;/Directory&gt;
  &lt;/VirtualHost&gt;
  </code></pre>
  
  <p>My attempt here is to force the X-Frame-Options to SAMEORIGIN for  xx.xx.com/publisher/new and xx.xx.com/publisher/revalidate.  I have tried separate Location and LocationMatch blocks that target the individual URLs in addition to the current configuration.  I have also tried using Header unset (rather than set) to remove the X-Frame-Options however it's being set.</p>
  
  <p>So far as I can tell these are the ONLY urls in the application that are returning the X-Frame-Options header set to DENY.</p>
  
  <p>Ideas?</p>