change frame option to sameOrigin because of wicket ajax objects MID-…

…5226 (MID-5216)
Evolveum · Apr 1, 2019 · 8d5b6b2 · 8d5b6b2
1 parent 4b2493d
commit 8d5b6b2
Showing 1 changed file with 1 addition and 1 deletion.
diff --git a/gui/admin-gui/src/main/java/com/evolveum/midpoint/web/boot/WebSecurityConfig.java b/gui/admin-gui/src/main/java/com/evolveum/midpoint/web/boot/WebSecurityConfig.java
@@ -155,7 +155,7 @@ protected void configure(HttpSecurity http) throws Exception {
         }
 
         http.headers().disable();
-        http.headers().frameOptions().deny();
+        http.headers().frameOptions().sameOrigin();
 
         if (Arrays.stream(environment.getActiveProfiles()).anyMatch(p -> p.equalsIgnoreCase("cas"))) {
             http.addFilterAt(casFilter(), CasAuthenticationFilter.class);