title: How to override X-Frame-Options for a controller or action in Rails 4
body: <p>Rails 4 appears to set a default value of <code>SAMEORIGIN</code> for the <code>X-Frame-Options</code> HTTP response header. This is <em>great</em> for security, but it does not allow for parts of your app to be available in an <code>iframe</code> on a different domain.</p>
  
  <p>You can override the value of <code>X-Frame-Options</code> globally using the <code>config.action_dispatch.default_headers</code> setting:</p>
  
  <pre><code>config.action_dispatch.default_headers['X-Frame-Options'] = "ALLOW-FROM https://apps.facebook.com"
  </code></pre>
  
  <p>But how do you override it for just a single controller or action?</p>