{"action":"closed","issue":{"url":"https://api.github.com/repos/symphonycms/symphony-2/issues/2480","labels_url":"https://api.github.com/repos/symphonycms/symphony-2/issues/2480/labels{/name}","comments_url":"https://api.github.com/repos/symphonycms/symphony-2/issues/2480/comments","events_url":"https://api.github.com/repos/symphonycms/symphony-2/issues/2480/events","html_url":"https://github.com/symphonycms/symphony-2/issues/2480","id":100565252,"number":2480,"title":"x-frame-options & access-control-allow-origin","user":{"login":"jensscherbl","id":1640033,"avatar_url":"https://avatars.githubusercontent.com/u/1640033?v=3","gravatar_id":"","url":"https://api.github.com/users/jensscherbl","html_url":"https://github.com/jensscherbl","followers_url":"https://api.github.com/users/jensscherbl/followers","following_url":"https://api.github.com/users/jensscherbl/following{/other_user}","gists_url":"https://api.github.com/users/jensscherbl/gists{/gist_id}","starred_url":"https://api.github.com/users/jensscherbl/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/jensscherbl/subscriptions","organizations_url":"https://api.github.com/users/jensscherbl/orgs","repos_url":"https://api.github.com/users/jensscherbl/repos","events_url":"https://api.github.com/users/jensscherbl/events{/privacy}","received_events_url":"https://api.github.com/users/jensscherbl/received_events","type":"User","site_admin":false},"labels":[],"state":"closed","locked":false,"assignee":{"login":"brendo","id":69268,"avatar_url":"https://avatars.githubusercontent.com/u/69268?v=3","gravatar_id":"","url":"https://api.github.com/users/brendo","html_url":"https://github.com/brendo","followers_url":"https://api.github.com/users/brendo/followers","following_url":"https://api.github.com/users/brendo/following{/other_user}","gists_url":"https://api.github.com/users/brendo/gists{/gist_id}","starred_url":"https://api.github.com/users/brendo/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/brendo/subscriptions","organizations_url":"https://api.github.com/users/brendo/orgs","repos_url":"https://api.github.com/users/brendo/repos","events_url":"https://api.github.com/users/brendo/events{/privacy}","received_events_url":"https://api.github.com/users/brendo/received_events","type":"User","site_admin":false},"milestone":{"url":"https://api.github.com/repos/symphonycms/symphony-2/milestones/24","html_url":"https://github.com/symphonycms/symphony-2/milestones/2.6.3","labels_url":"https://api.github.com/repos/symphonycms/symphony-2/milestones/24/labels","id":1108364,"number":24,"title":"2.6.3","description":"","creator":{"login":"brendo","id":69268,"avatar_url":"https://avatars.githubusercontent.com/u/69268?v=3","gravatar_id":"","url":"https://api.github.com/users/brendo","html_url":"https://github.com/brendo","followers_url":"https://api.github.com/users/brendo/followers","following_url":"https://api.github.com/users/brendo/following{/other_user}","gists_url":"https://api.github.com/users/brendo/gists{/gist_id}","starred_url":"https://api.github.com/users/brendo/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/brendo/subscriptions","organizations_url":"https://api.github.com/users/brendo/orgs","repos_url":"https://api.github.com/users/brendo/repos","events_url":"https://api.github.com/users/brendo/events{/privacy}","received_events_url":"https://api.github.com/users/brendo/received_events","type":"User","site_admin":false},"open_issues":2,"closed_issues":20,"state":"open","created_at":"2015-05-13T10:48:39Z","updated_at":"2015-08-24T00:59:22Z","due_on":"2015-08-27T14:00:00Z","closed_at":null},"comments":27,"created_at":"2015-08-12T15:06:09Z","updated_at":"2015-08-24T00:59:22Z","closed_at":"2015-08-24T00:59:22Z","body":"Is it really such a good idea to set [`x-frame-options` and `access-control-allow-origin`][1] headers by default?\r\n\r\nFrom my understanding, this changes the default browser behaviour, and things like loading a Symphony page into an `iframe` on another site wouldn't work as expected.\r\n\r\nAnd if you really want to keep it, could it at least be set before the `FrontendPreRenderHeaders`delegate so it can be removed by an extension?\r\n\r\nIn my opinion, this is another situation where Symphony just makes an assumption what might be best for the developer, and makes it hard to get rid of the forced core behaviour.\r\n\r\n[1]: https://github.com/symphonycms/symphony-2/blob/integration/symphony/lib/toolkit/class.frontendpage.php#L240"}}