Fix Rails oauth facebook x-frame-options sameorigin error

Question

I can\'t for the life of me get my Facebook canvas app to display. Chrome console displays this error and nothing shows up inside the iframe - it\'s blank:

Refus

Answer 1

I found this part of the edge guide, which explains Rails 4's default headers, to be useful:

http://edgeguides.rubyonrails.org/security.html#default-headers

Here is the main point, copied and pasted:

Every HTTP response from your Rails application receives the following default security headers.

config.action_dispatch.default_headers = { 'X-Frame-Options' => 'SAMEORIGIN', 'X-XSS-Protection' => '1; mode=block',
'X-Content-Type-Options' => 'nosniff' }

You can configure defaultheaders in config/application.rb.

config.action_dispatch.default_headers = { 'Header-Name' => 'Header-Value', 'X-Frame-Options' => 'DENY' }

Or you can remove them.

config.action_dispatch.default_headers.clear