Hapi is not honouring Route security config option

[imtiazwazir]

Hapi is sending 2 x-frame-options headers while I have set only one in route config.

client iframe error:

client header response:

my route has following config:

config: { description: 'Return generaed url for client', cors: true, security: { xframe: { rule: 'allow-from', source: 'http://datameister.co.jp' } }, ...

my package.json dependency looks something like below
"dependencies": { "file-extension": "^3.1.0", "glue": "^4.0.0", "handlebars": "^4.0.6", "hapi": "^16.0.1", "hapi-auth-basic": "^4.2.0", "hapi-sequelize": "^3.0.4", "hoek": "^4.1.0", "inert": "^4.0.3", "joi": "^10.0.5", "mysql": "^2.12.0", "mysql2": "^1.1.2", "nes": "^6.3.2", "sequelize": "^3.27.0", "vision": "^4.1.1" },

[Marsup]

When I see Server: Apache, I can only doubt that it's hapi's fault. Could you check without it ?

[AdriVanHoudt]

Dupe of outmoded/discuss#419

[imtiazwazir]

Thanks for your help and closing this topic without my input

[calmdev]

He closed it because you've posted the same issue twice in two different places within the same org. It was even cross referenced for you before being closed. Why not continue the discussion there instead and provide feedback to those who are trying to help you. You've already been asked multiple times to try without apache. It seems people are waiting for your input.