Empty X-Frame-Options header is sent

[dev4223]

Hello,

I'm using your plugin with PIWIK. When I load the iframe into a site I'll get "Invalid 'X-Frame-Options' header encountered when loading 'https://piwik.holgerkral.de/index.php?module=CoreAdminHome&action=optOut&idsite=2&language=de': '' is not a recognized directive. The header will be ignored."

This URL is shown in PIWIK backend: https://piwik.holgerkral.de/index.php?module=CoreAdminHome&action=optOut&idsite=2&language=de and it sents an empty X-Frame-Options header (> curl -I ....)

In your screenshot the URL is https://piwik.holgerkral.de/index.php?module=CustomOptOut&action=optOut&idsite=2&language=de (CustomOptOut instead of CoreAdminHome as module). Testet with curl it doesn't sent a X-Frame-Options header. But when I check this second URL in browser it is redirected to the first URL and so sending the empty header.

Best regards Holger Kral

[Zeichen32]

The URL " https://piwik.holgerkral.de/index.php?module=CustomOptOut&action=optOut&idsite=2&language=de" is the old way of using the plugin. In the current version, you can use the original piwik url.

The empty X-Frame-Options header is added by piwik. See: https://github.com/piwik/piwik/issues/10167

[dev4223]

Hi There,

OK, i have set the old URL only for testing. So do you mean, we have to wait until this fix is merged into the stable master?

Best regards Holger

[Zeichen32]

Yes we have to wait until this fixed by the piwik core team.