How to enable X-Frame-Options in WSO2 5.4.1? - wso2

Question

I tried to configure my jaggery.conf file as stated in the documentation to allow framing as follows :
"filters":[
{
"name":"HttpHeaderSecurityFilter",
"class":"org.apache.catalina.filters.HttpHeaderSecurityFilter",
"params" : [
{"name" : "hstsEnabled", "value" : "false"},
{ "name": "antiClickJackingOption", "value": "SAMEORIGIN" }
]
},
{
"name": "ContentTypeBasedCachePreventionFilter",
"class": "org.wso2.carbon.ui.filters.cache.ContentTypeBasedCachePreventionFilter",
"params":[
{"name": "patterns", "value": "text/html\" ,application/json\" ,plain/text"},
{"name": "filterAction", "value": "enforce"},
{"name": "httpHeaders", "value": "Cache-Control: no-store, no-cache, must-revalidate, private"}
]
}
],
Despite, in my client app, I still get a message saying that framing isn't allowed.
Load denied by X-Frame-Options: https://localhost:9444/authenticationendpoint/oauth2_error.do?oauthErrorCode=invalid_callback&oauthErrorMsg=Registered+callback+does+not+match+with+the+provided+url. does not permit framing.

Answer 1

Since this issue is coming from authenticationendpoint, you have to configure HttpHeaderSecurityFilter filter in the file <IS_HOME>/repository/deployment/server/webapps/authenticationendpoint/WEB-INF/web.xml as follows.
<filter>
<filter-name>HttpHeaderSecurityFilter</filter-name>
<filter-class>org.apache.catalina.filters.HttpHeaderSecurityFilter</filter-class>
<init-param>
<param-name>hstsEnabled</param-name>
<param-value>false</param-value>
</init-param>
<init-param>
<param-name>antiClickJackingOption</param-name>
<param-value>SAMEORIGIN</param-value>
</init-param>
</filter>
Btw, the error in the shared URL is Registered+callback+does+not+match+with+the+provided+url, you can check whether the redirect_uri defined in the request URL is matching with the one configured in the service provider.