3 ms·

IIRC the [responsible org] says we don't have to add the `X-` to custom headers anymore. Edit: IETF and IANA are the orgs RFC 4229 https://www.rfc-editor.org/

IIRC the [responsible org] says we don't have to add the `X-` to custom headers anymore. Edit: IETF and IANA are the orgs RFC 4229 https://www.rfc-editor.org/rfc/rfc4229.html https://www.rfc-editor.org/rfc/rfc4229.html

semiquaver 4y ago
This is not a custom header (i.e. one with no UA semantics), it is a standardized header called X-Frame-Options which requires the “X-“ for browsers to recognize it. The prefix is an artifact of the era the header was introduced in. https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-Frame-Options https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-...
- thayne 4y ago
  It's also been deprecated in favor of the content-security-policy header.
quelltext 4y ago
Was curious what they say about it but the link didn't seem to have anything on custom headers.