title: how do I set X-Frame-Options response header to allow-from value(s) using spring java config?
body: <p>How do I set X-Frame-Options response header with a value of allow-from using spring java config?</p>
  
  <pre class="lang-java prettyprint-override"><code>http.headers().disable()
      .addHeaderWriter(new XFrameOptionsHeaderWriter(
        new WhiteListedAllowFromStrategy(
          Arrays.asList("https://example1.com", "https://example2.com"))));
  </code></pre>
  
  <p>In Http Response headers I get:</p>
  
  <blockquote>
    <p>X-Frame-Options:"ALLOW-FROM DENY".</p>
  </blockquote>
  
  <p>Why aren't my origins listed in the header value?</p>