# En ongeldige response header wordt ingesteld vanuit de embed controller
**URL:** https://meta.discourse.org/t/and-invalid-response-header-is-being-set-from-embed-controller/183178
**Category:** Support
**Created:** [14 maart 2021 om 02:55 UTC](https://meta.discourse.org/t/and-invalid-response-header-is-being-set-from-embed-controller/183178 "2021-03-14T02:55:36Z")
**Posts on this page:** 5
**Page:** 1
### Author:  [@hjr265](https://meta.discourse.org/u/hjr265)
#### Post date: [14 maart 2021 om 02:55 UTC](https://meta.discourse.org/t/and-invalid-response-header-is-being-set-from-embed-controller/183178/1 "2021-03-14T02:55:37Z")
>
MDN doesn’t specify “ALLOWALL” as a possible value for the X-Frame-Options header. On Firefox, when loading any page with an embed, this can be seen in the console:
Any way to not send that header and specify the frame-ancestors directive for the Content-Security-Policy header? From the code it doesn’t seem there is a way to configure this.
---
### Author:  [@Falco](https://meta.discourse.org/u/Falco)
#### Post date: [14 maart 2021 om 15:52 UTC](https://meta.discourse.org/t/and-invalid-response-header-is-being-set-from-embed-controller/183178/2 "2021-03-14T15:52:48Z")
I saw that error while working on the embed in our [new blog](https://blog.discourse.org). The easy thing to do is to just remove this header right?
---
### Author:  [@hjr265](https://meta.discourse.org/u/hjr265)
#### Post date: [15 maart 2021 om 12:58 UTC](https://meta.discourse.org/t/and-invalid-response-header-is-being-set-from-embed-controller/183178/3 "2021-03-15T12:58:35Z")
I think so, yes. I am assuming you meant removing it from Discourse (vs. hiding it using some Nginx configuration). The header itself is considered obsolete now anyway. There are other occurrences of the same header in that file.
> **Note:** The Content-Security-Policy HTTP header has a frame-ancestors directive which obsoletes this header for supporting browsers.
> **[X-Frame-Options header - HTTP | MDN](https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Headers/X-Frame-Options)**
>
> The HTTP X-Frame-Options response header can be used to indicate whether a browser should be allowed to render the document in a ,
---
### Author:  [@Falco](https://meta.discourse.org/u/Falco)
#### Post date: [23 maart 2021 om 00:17 UTC](https://meta.discourse.org/t/and-invalid-response-header-is-being-set-from-embed-controller/183178/4 "2021-03-23T00:17:03Z")
This is fixed now:
> [@Mitigate XSS Attacks with Content Security Policy](https://meta.discourse.org/t/mitigate-xss-attacks-with-content-security-policy/104243/37):
>
> We just landed support for CSP frame-ancestors directive. It’s disabled by default for now behind the content security policy frame ancestors site setting. You can add domains to the list using via /admin/customize/embedding as always. This directive will be enabled by default in the next release cycle.
---
### Author:  [@Falco](https://meta.discourse.org/u/Falco)
#### Post date: [27 maart 2021 om 08:00 UTC](https://meta.discourse.org/t/and-invalid-response-header-is-being-set-from-embed-controller/183178/5 "2021-03-27T08:00:48Z")
This topic was automatically closed after 4 days. New replies are no longer allowed.