Files
Gitea/modules/setting
silverwind 5f8e19fcef Move X_FRAME_OPTIONS setting from cors to security section (#30256)
## Summary

- Move `cors.X_FRAME_OPTIONS` to `security.X_FRAME_OPTIONS` (old
location still works with a deprecation warning)
- Support `"unset"` as a special value to remove the `X-Frame-Options`
header entirely
- Remove `X-Frame-Options` header from API responses (only set for
web/HTML responses)

## Migration

If you had customized `cors.X_FRAME_OPTIONS`, move it to the
`[security]` section. The old location is deprecated and will be removed
in a future release.

---------

Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
Co-authored-by: wxiaoguang <wxiaoguang@gmail.com>
2026-02-22 20:26:46 +00:00
..
2026-02-22 08:01:43 +01:00
2023-12-19 09:29:05 +00:00
2023-07-04 18:36:08 +00:00
2025-06-03 01:26:19 +00:00
2025-09-13 18:01:00 +00:00
2025-10-23 08:35:48 +00:00
2025-03-31 01:53:48 -04:00
2023-10-10 18:47:49 +08:00
2026-02-22 08:01:43 +01:00
2023-02-20 16:18:26 -06:00