clickjacking

Hello mkm,

Depending on the origin of the loaded frame you can use the "SAMEORIGIN" or the "ALLOW-FROM uri"

 when HTTP_RESPONSE {
   HTTP::header replace X-Frame-Options "SAMEORIGIN"
}

or this one

 when HTTP_RESPONSE {
       HTTP::header replace X-Frame-Options "ALLOW-FROM https://mysite.domain.com"
    }