在 Apache HTTP Server 2.2 中设置 X-FRAME-OPTIONS 时出错

Question

当我尝试将以下代码添加到 httpd.conf 文件尾部时出现以下问题：

#iframe config
Header always append X-Frame-Options ALLOW-FROM http://xxxx

Syntax error on line 489 of C:/Program Files (x86)/Apache Software Foundation/Ap ache2.2/conf/httpd.conf: Invalid command 'Header', perhaps misspelled or defined by a module not included in the server configuration

Answer 1

1. Add/uncomment 下面加载命令

    LoadModule headers_module modules/mod_headers.so
   

2. 将行改为下面

    #Header set X-Frame-Options "ALLOW-FROM http://xxxxxx"
    #Header set X-Frame-Options "DENY"
    Header set X-Frame-Options "SAMEORIGIN"
   

Answer 2

由于httpd.conf文件接受名称值对格式参数，值必须用双引号引起来。

喜欢：

Header set x-frame-options "DENY"