WComponents sets the HTTP Header X-Frame-Options to the value SAMEORIGIN. This is to alleviate the potential for clickjacking. This header is set in the method com.github.bordertech.wcomponents.servlet.HttpServletHelper.addGenericHeaders(UIContext, WComponent) (addGenericHeaders).

If you have a need to change this header (to DENY, ALLOW-FROM or to remove it) then this method can be overridden. This could be done, for example in an implementation of WServlet.

• X-Frame-Options on MDN
• RFC 7034