# Changing X-Frame-Options to allow-from doesn't succeed in .toml file

**URL:** <https://community.fly.io/t/changing-x-frame-options-to-allow-from-doesnt-succeed-in-toml-file/11625>\
**Category:** Questions / Help\
**Tags:** laravel, login-only\
**Created:** [March 21, 2023, 11:25am UTC](https://community.fly.io/t/changing-x-frame-options-to-allow-from-doesnt-succeed-in-toml-file/11625 "2023-03-21T11:25:21Z")\
**Posts on this page:** 1\
**Showing post:** 2

<div class="post-metadata">

**Author:** ![fideloper-fly](https://sea1.discourse-cdn.com/fly1/user_avatar/community.fly.io/fideloper-fly/32/3834_2.png) [@fideloper-fly](https://community.fly.io/u/fideloper-fly)\
**Post date:** [March 21, 2023, 12:12pm UTC](https://community.fly.io/t/changing-x-frame-options-to-allow-from-doesnt-succeed-in-toml-file/11625/2 "2023-03-21T12:12:19Z")

</div>

Hi!

## Note:

Most importantly, the `allow-from` value for that header doesn’t appear to be widely supported (see [here](https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-Frame-Options))

I think omitting the header, or using a CSP header’s [frame-ancestors](https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy/frame-ancestors) is your best bet.

* * *

## Testing it Out

Testing this out myself, I set:

```auto
  [services.ports.http_options.response.headers]
  X-Frame-Options = "DENY"

```

Chrome seems to keep responding with the `SAMEORIGIN` response (not sure if that’s cached or something?)

 ![image](https://global.discourse-cdn.com/fly1/original/3X/4/d/4d57a125cbdf422920c12f13714c5e8efd43406a.png)

But `curl` showed the updated header value **(I suggest you test with `curl` as well!)**

Note that is says `DENY` now:

 ![image](https://global.discourse-cdn.com/fly1/original/3X/d/8/d8f9e4f6f55abfa3472a093c4fc3a9260c55ebeb.png)

* * *

## What To Do

👉👉👉 Overall I think the most important thing to find here is that `allow-from` isn’t going to work in modern browsers. You should check out CSP headers, or try to get Fly to [remove the `x-frame-options` header](https://community.fly.io/t/new-feature-basic-http-response-header-modification/3594).

---

_[View the full topic](https://community.fly.io/t/changing-x-frame-options-to-allow-from-doesnt-succeed-in-toml-file/11625)._