we need to access the WSO2IS with in a iframe but facing the issue of X-Frame-options.We need to authenticate the ROR application by WSO2IS within Iframe. I get X-Frame-Options: DENY headers and since the WSO2IS is located in a different domain than the application. Any suggestions?
You need to configure org.apache.catalina.filters.HttpHeaderSecurityFilter in tomcat to get this to work. The place you need to configure is like below.
- If you need to enable this for management console and /services context configure in /repository/conf/tomcat/carbon/WEB-INF/web.xml
- If you need to enable this for another web app (for example oauth2 web app), you need to do this in web.xml of the web app. (/repository/deployment/server/webapps//WEB-INF/web.xml)
You may need to configure antiClickJackingEnabled, antiClickJackingOption and antiClickJackingUri attributes for the filter.
For more information about configuring the tomcat filter, follow https://tomcat.apache.org/tomcat-7.0-doc/config/filter.html