title: Blank Canvas => 'Refused to display document because display forbidden by X-Frame-Options.'
body: <p>when the canvas app is loaded within the iframe nothing is display and on Chrome Firebug Console I see the error:</p>
  
  <blockquote>
    <p>Refused to display document because display forbidden by X-Frame-Options.</p>
  </blockquote>
  
  <p><img src="https://i.stack.imgur.com/gKTwU.png" alt="Firebug Console"></p>
  
  <p>I tried this solution: <a href="https://stackoverflow.com/questions/6666423/overcoming-display-forbidden-by-x-frame-options">Overcoming &quot;Display forbidden by X-Frame-Options&quot;</a></p>
  
  <pre><code> class ApplicationController &lt; ActionController::Base
   protect_from_forgery
   before_filter :set_xframeoption
  
   def set_xframeoption
    response.headers["X-Frame-Options"]='GOFORIT'
   end
  
   end
  </code></pre>
  
  <p>But I have the same error. Any solution?</p>
  
  <p>Thanks</p>
  
  <pre><code>- FB Resquest Header -
  GET /dropis_app/ HTTP/1.1
  Host: apps.facebook.com
  Connection: keep-alive
  Cache-Control: max-age=0
  User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_7_2) AppleWebKit/535.7 (KHTML, like Gecko) Chrome/16.0.912.77 Safari/535.7
  Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
  Accept-Encoding: gzip,deflate,sdch
  Accept-Language: en-US,en;q=0.8
  Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
  Cookie: [lot of stuff]
  
  - FB Response Header -
  HTTP/1.1 200 OK
  Cache-Control: private, no-cache, no-store, must-revalidate
  Expires: Sat, 01 Jan 2000 00:00:00 GMT
  P3P: CP="Facebook does not have a P3P policy. Learn why here: http://fb.me/p3p"
  Pragma: no-cache
  X-Content-Type-Options: nosniff
  X-Frame-Options: DENY
  X-XSS-Protection: 1; mode=block
  Set-Cookie: wd=deleted; expires=Thu, 01-Jan-1970 00:00:01 GMT; path=/; domain=.facebook.com; httponly
  Content-Encoding: gzip
  Content-Type: text/html; charset=utf-8
  X-FB-Debug: JGyR/rXLGOKtchBAPFmyYiPZrd5npWbORZgq4sirM1Q=
  X-Cnection: close
  Transfer-Encoding: chunked
  Date: Wed, 01 Feb 2012 17:58:00 GMT
  
  
  
  - iFrame Request Header -
  Request URL:https://foobar.herokuapp.com/
  Request Method:POST
  Status Code:302 Found
  Request Headersview source
  Accept:text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
  Accept-Charset:ISO-8859-1,utf-8;q=0.7,*;q=0.3
  Accept-Encoding:gzip,deflate,sdch
  Accept-Language:en-US,en;q=0.8
  Cache-Control:max-age=0
  Connection:keep-alive
  Content-Length:433
  Content-Type:application/x-www-form-urlencoded
  Host:dropis.herokuapp.com
  Origin:https://apps.facebook.com
  Referer:https://apps.facebook.com/foobar/
  User-Agent:Mozilla/5.0 (Macintosh; Intel Mac OS X 10_7_2) AppleWebKit/535.7 (KHTML, like Gecko) Chrome/16.0.912.77 Safari/535.7
  Form Dataview URL encoded
  
  - iFrame Form Data -
  signed_request: [removed]
  
  - iFrame Response Header -
  Response Headersview source
  Cache-Control:no-cache
  Connection:keep-alive
  Content-Length:195
  Content-Type:text/html; charset=utf-8
  Date:Thu, 02 Feb 2012 16:35:27 GMT
  Location:https://graph.facebook.com/oauth/authorize?client_id=[removed]&amp;redirect_uri=https://foobar.herokuapp.com/users/callback
  Server:WEBrick/1.3.1 (Ruby/1.9.2/2011-07-09)
  Set-Cookie:_dropis_static_session=[removed]; path=/; HttpOnly
  X-Rack-Cache:invalidate, pass
  X-Runtime:0.001540
  X-Ua-Compatible:IE=Edge,chrome=1
  </code></pre>