Refused to display '' in a frame because it set 'X-Frame-Options' to 'deny'

    Header always append X-Frame-Options SAMEORIGIN

    add_header X-Frame-Options SAMEORIGIN;

    <system.webServer>
    ...
        <httpProtocol>
        <customHeaders>
            <add name="X-Frame-Options" value="SAMEORIGIN" />
        </customHeaders>
        </httpProtocol>
        ...
    </system.webServer>

    (HttpSecurity) http.headers().frameOptions().sameOrigin()

public class MyFilter implements Filter { 

    public void doFilter(ServletRequest req, ServletResponse res, FilterChain chain) throws IOException, ServletException {  
        HttpServletRequest request = (HttpServletRequest) req;    
        HttpServletResponse response = (HttpServletResponse) res;    
    response.setHeader("x-frame-options", "SAMEORIGIN");    
    chain.doFilter(request, response);  
    }    

    public void init(FilterConfig config) throws ServletException {  
    }  

    public void destroy() {  
    }  
}