clickjacking protection middleware this module provides a middleware that implements protection against a malicious site loading resources from your site in a hidden frame set the xframeoptions http header in http responses do not set the header if it s already set or if the response contains a xframeoptionsexempt value set to true by default set the xframeoptions header to deny meaning the response cannot be displayed in a frame regardless of the site attempting to do so to enable the response to be loaded on a frame within the same site set xframeoptions in your project s django settings to sameorigin don t set it if it s already in the response don t set it if they used xframeoptionsexempt get the value to set for the xframeoptions header use the value from the xframeoptions setting or deny if not set this method can be overridden if needed allowing it to vary based on the request or response set the x frame options http header in http responses do not set the header if it s already set or if the response contains a xframe_options_exempt value set to true by default set the x frame options header to deny meaning the response cannot be displayed in a frame regardless of the site attempting to do so to enable the response to be loaded on a frame within the same site set x_frame_options in your project s django settings to sameorigin don t set it if it s already in the response don t set it if they used xframe_options_exempt get the value to set for the x_frame_options header use the value from the x_frame_options setting or deny if not set this method can be overridden if needed allowing it to vary based on the request or response
from django.conf import settings
from django.utils.deprecation import MiddlewareMixin


class XFrameOptionsMiddleware(MiddlewareMixin):
    

    def process_response(self, request, response):
        
        if response.get("X-Frame-Options") is not None:
            return response

        
        if getattr(response, "xframe_options_exempt", False):
            return response

        response.headers["X-Frame-Options"] = self.get_xframe_options_value(
            request,
            response,
        )
        return response

    def get_xframe_options_value(self, request, response):
        
        return getattr(settings, "X_FRAME_OPTIONS", "DENY").upper()