From 0b5fb8e72c74e41d250f35c8c3df3f3a13d367f3 Mon Sep 17 00:00:00 2001 From: Simeon J Morgan Date: Tue, 2 Jun 2015 14:11:01 +1000 Subject: [PATCH] Fixed #24896 -- Doc'd clickjacking protection doesn't overwrite X-Frame-Options header. --- docs/ref/clickjacking.txt | 3 +++ 1 file changed, 3 insertions(+) diff --git a/docs/ref/clickjacking.txt b/docs/ref/clickjacking.txt index b7ba915eee..06d264c115 100644 --- a/docs/ref/clickjacking.txt +++ b/docs/ref/clickjacking.txt @@ -45,6 +45,9 @@ site: 2. A set of view decorators that can be used to override the middleware or to only set the header for certain views. +The ``X-Frame-Options`` HTTP header will only be set by the middleware or view +decorators if it is not already present in the response. + How to use it =============