What is the correct option to allow all?

[3den]

I noticed that by default you set the value 'Deny'. I searched online and besides that I could only find SAMEORIGIN, and ALLOW-FROM. Do you know what is the value that I can use to allow all domains?

Thanks :)

[domharrington]

The correct option to allow all is to not have this header set. That way it can be <iframe>'d from any page. Is that what you mean?

[staminna]

I think he wants the opposite.
The example is still resulting in

Refused to display 'http://localhost:3000/' in a frame because it set 'X-Frame-Options' to 'SAMEORIGIN'.

How do you set this to Allow?
Do you think App/play store allow apps to use Iframe?

[domharrington]

If you want your website to be able to be embedded in an iframe, then you don't need this header to be set at all.