Spring boot X-Frame-Options 처리

iframe 사용시 에러 발생
브라우져의 header 정보에서 확인할 수 있
실제로는 Ext.window.Window 사용하여 팝업 실행하여 서버에 호출함

chrome-error://chromewebdata/:1 Refused to display 'http://localhost/' in a frame because it set 'X-Frame-Options' to 'deny'.

X-Frame-Options 값

• DENY – Prevents the site from being embedded in any iframe.
• SAMEORIGIN – Allows embedding only if the parent is from the same origin.
• ALLOW-FROM <url> – Allows embedding only from specific origins (deprecated in most browsers).

Spring boot에서 조치
SecuriyFilterChain에 아래 내용을 추가하여 처리
.headers(headers -> headers.frameOptions(frameOptions -> frameOptions.sameOrigin()))

import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.web.SecurityFilterChain;

@Configuration
public class SecurityConfig {

    @Bean
    public SecurityFilterChain securityFilterChain(HttpSecurity http) throws Exception {
        http
            .headers(headers -> headers.frameOptions(frameOptions -> frameOptions.sameOrigin())) // Allow same-origin
            .authorizeHttpRequests(auth -> auth.anyRequest().permitAll()); // Permit all requests

        return http.build();
    }
}