Suggestion: Remove X-Frame-Options header

[jorianvo]

Hi!

According to MDN the X-Frame-Options is deprecated and no longer recommended:

Deprecated: This feature is no longer recommended. Though some browsers might still support it, it may have already been removed from the relevant web standards, may be in the process of being dropped, or may only be kept for compatibility purposes. Avoid using it, and update existing code if possible; see the compatibility table at the bottom of this page to guide your decision. Be aware that this feature may cease to work at any time.

So I was wondering if it makes sense to remove support for it?

[cak]

Hi @jorianvo, thanks for raising this and for the thoughtful discussion.

For v2.0, I decided not to remove the X-Frame-Options header yet, primarily for backward compatibility and to avoid surprising users who still rely on it directly or indirectly through legacy tooling.

That said, the documentation has been updated to clearly recommend Content Security Policy using the frame-ancestors directive as the modern and preferred mechanism, and to explain how it overlaps with and supersedes X-Frame-Options in most cases.

This strikes a balance for now:

• existing users are not broken by an unexpected removal
• new users are guided toward CSP
• the intent and direction are explicit

I plan to revisit removal or a stricter default in a future major release once CSP adoption is more universal.

Thanks again for the suggestion. It helped shape both the documentation and the longer term roadmap.