{"action":"created","issue":{"url":"https://api.github.com/repos/alphagov/whitehall/issues/2080","labels_url":"https://api.github.com/repos/alphagov/whitehall/issues/2080/labels{/name}","comments_url":"https://api.github.com/repos/alphagov/whitehall/issues/2080/comments","events_url":"https://api.github.com/repos/alphagov/whitehall/issues/2080/events","html_url":"https://github.com/alphagov/whitehall/pull/2080","id":67108621,"number":2080,"title":"Set `X-Frame-Options` header to `ALLOWALL`","user":{"login":"alexmuller","id":121219,"avatar_url":"https://avatars.githubusercontent.com/u/121219?v=3","gravatar_id":"","url":"https://api.github.com/users/alexmuller","html_url":"https://github.com/alexmuller","followers_url":"https://api.github.com/users/alexmuller/followers","following_url":"https://api.github.com/users/alexmuller/following{/other_user}","gists_url":"https://api.github.com/users/alexmuller/gists{/gist_id}","starred_url":"https://api.github.com/users/alexmuller/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/alexmuller/subscriptions","organizations_url":"https://api.github.com/users/alexmuller/orgs","repos_url":"https://api.github.com/users/alexmuller/repos","events_url":"https://api.github.com/users/alexmuller/events{/privacy}","received_events_url":"https://api.github.com/users/alexmuller/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":1,"created_at":"2015-04-08T11:31:32Z","updated_at":"2015-04-08T12:01:02Z","closed_at":null,"pull_request":{"url":"https://api.github.com/repos/alphagov/whitehall/pulls/2080","html_url":"https://github.com/alphagov/whitehall/pull/2080","diff_url":"https://github.com/alphagov/whitehall/pull/2080.diff","patch_url":"https://github.com/alphagov/whitehall/pull/2080.patch"},"body":"Rails 4 starts setting a default `X-Frame-Options` policy of `SAMEORIGIN` which prevents this application from being displayed in an iframe outside of GOV.UK, for example in the side-by-side browser.\r\n\r\nAs this application only contains information pages and nothing transactional, we have decided to allow it to be included in iframes on external sites.\r\n\r\n- [Pivotal](https://www.pivotaltracker.com/n/projects/780127/stories/92019798)\r\n- [Zendesk](https://govuk.zendesk.com/tickets/1001074)"},"comment":{"url":"https://api.github.com/repos/alphagov/whitehall/issues/comments/90892143","html_url":"https://github.com/alphagov/whitehall/pull/2080#issuecomment-90892143","issue_url":"https://api.github.com/repos/alphagov/whitehall/issues/2080","id":90892143,"user":{"login":"edds","id":35035,"avatar_url":"https://avatars.githubusercontent.com/u/35035?v=3","gravatar_id":"","url":"https://api.github.com/users/edds","html_url":"https://github.com/edds","followers_url":"https://api.github.com/users/edds/followers","following_url":"https://api.github.com/users/edds/following{/other_user}","gists_url":"https://api.github.com/users/edds/gists{/gist_id}","starred_url":"https://api.github.com/users/edds/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/edds/subscriptions","organizations_url":"https://api.github.com/users/edds/orgs","repos_url":"https://api.github.com/users/edds/repos","events_url":"https://api.github.com/users/edds/events{/privacy}","received_events_url":"https://api.github.com/users/edds/received_events","type":"User","site_admin":false},"created_at":"2015-04-08T12:01:02Z","updated_at":"2015-04-08T12:01:02Z","body":"Is there a way to have this only set on non-admin pages? My understanding is that this would add the header for *all* pages and a malicious user could in theory create an invisible iframe, which is an admin page, and position it in such a way as an unsuspecting logged in admin user accidentally clicks something in the admin they weren't expecting. I could be wrong in that understanding though."}}