Removed X-Frame-Options because it doesn't help with this issue, and …

…is potentially insecure
spacetelescope · Nov 25, 2024 · a2c8a7b · a2c8a7b
1 parent 7354f33
commit a2c8a7b
Showing 1 changed file with 0 additions and 4 deletions.
diff --git a/jwql/website/jwql_proj/settings.py b/jwql/website/jwql_proj/settings.py
@@ -40,10 +40,6 @@
 # SECURITY WARNING: don't run with debug turned on in production!
 DEBUG = get_config()['django_debug']
 
-# SECURITY WARNING: This turns the default X_FRAME_OPTIONS value/header from 'DENY' to
-# 'SAMEORIGIN', which might potentially allow clickjacking.
-X_FRAME_OPTIONS = 'SAMEORIGIN'
-
 ALLOWED_HOSTS = ['*']
 
 # Application definition