I noticed this question, which discusses various ways to alter HTTP Response Headers.

Where would I be able to execute:


I attempted to place this within my THEMENAME.theme file, but perhaps I am not doing it right because $response is not defined where I am using it.

Where does $response come from?

Where can I execute $response->headers->remove('X-Frame-Options');?

Note: I understand the risks of removing the HTTP Header. This is for development/testing purposes only.

  • Sounds like it should be an EventSubscriber to me. – Kevin Jul 7 '17 at 21:41
  • @Kevin, are custom modules required for EventSubscribers? – Raphael Rafatpanah Jul 7 '17 at 22:41
  • Yes. Check some of the docs and blogs about them. – Kevin Jul 7 '17 at 22:43
  • @Kevin, can you clarify where a custom service should live relative to the root Drupal installation? I've tried from the root level and also from /modules, and Drupal is not picking up my Event subscription. – Raphael Rafatpanah Jul 8 '17 at 2:06

Got it!

From these two sources:

I realized that I was missing a mymodule.info.yml file.

  ├── mymodule.info.yml 
  ├── mymodule.services.yml 
  └── src 
    └── EventSubscriber 
      └── RemoveXFrameOptionsSubscriber.php

Then, go to /admin/modules in the backend (Extend tab) and install the new module & clear all caches afterwards.


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.