I'm afraid your problem is the combination of having a reverse proxy cache in front of Drupal, and a stupid design flaw (IMHO) with the
X-Frame-Options
header. A site may specify only a single value for
Allow-From
, so in order to support multiple values, the site has to send the
correct
header for any given should-be-allowed request. See
http://tools.ietf.org/html/rfc7034#section-2.3.2.3
So SecKit can't help you here, because Varnish is sending cached responses with the 'wrong' header value.
I think your best option is to implement this header in Varnish (or in your web server, if that's in front).
You could also Vary your responses on the Origin header in order that each unique origin gets a different cached response (which will be generated by Drupal). For the framing use-case that might even be ok -- but it wouldn't be my first choice of approach.
I'm afraid your problem is the combination of having a reverse proxy cache in front of Drupal, and a stupid design flaw (IMHO) with the
X-Frame-Optionsheader. A site may specify only a single value forAllow-From, so in order to support multiple values, the site has to send the correct header for any given should-be-allowed request. See http://tools.ietf.org/html/rfc7034#section-2.3.2.3So SecKit can't help you here, because Varnish is sending cached responses with the 'wrong' header value.
I think your best option is to implement this header in Varnish (or in your web server, if that's in front).
You could also Vary your responses on the Origin header in order that each unique origin gets a different cached response (which will be generated by Drupal). For the framing use-case that might even be ok -- but it wouldn't be my first choice of approach.