mirror of
https://github.com/spring-projects/spring-security.git
synced 2025-03-06 21:39:25 +00:00
XFrameOptionsHeaderWriter should not *add*, but *set* the X-Frame-Options header. According to https://tools.ietf.org/html/rfc7034#section-2.1, having multiple values for the header is disallowed: "There are three different values for the header field. These values are mutually exclusive; that is, the header field MUST be set to exactly one of the three values." With this change, only the latest XFrameOptionsHeaderWriter will remain.