Examining the core/domainpolicy model to see what it does, it:
- Determines the Magento area
- Loads the security policy for the area (from configuration). This setting comes straight from a select box in admin System -> Configuration.
- Converts the result to an internal code for the option
- Checks the result is truthy and if so:
- Adds the X-Frame-Options header
This is not giving you much flexibility for changing the default behaviour. The only real choice is to extend the method and add your own logic to prevent it, for example:
# File: app/code/local/Vendor/Module/Model/Domainpolicy.php
<?php
/**
* Add ability to disable the X-Frame-Options header for certain controllers
*/
class Vendor_Module_Model_Domainpolicy extends Mage_Core_Model_Domainpolicy
{
/**
* Add X-Frame-Options header to response, depends on config settings
*
* @param Varien_Object $observer
* @return self
*/
public function addDomainPolicyHeader($observer)
{
if (Mage::registry('disable_x_frame_options_header')) {
return $this;
}
return parent::addDomainPolicyHeader($observer);
}
}
Note! The core Mage module uses the full class name of the Domainpolicy observer in its definition, which means you can't extend it using the normal Magento rewrite system. You can either:
- Re-define the event definition in your module's
config.xml file (which takes priority because it's loaded later than core), or
- Use a file-based override of the entire class
The first option is better to me. This means you redefine the entire event declaration, only changing the class name to your own.
This will work on the fact that you set a Magento registry item which the observer can catch to determine that it shouldn't add the header.
All you need to do is add it to your controller in the preDispatch() method. You will see that Mage_Core_Controller_Varien_Action::preDispatch() is the point where the controller_action_predispatch event is dispatched - this is where the observer will be fired, so ensure you add the logic before the parent method's logic:
# File: app/code/local/Vendor/Module/controllers/PreviewController.php
/**
* Do not add X-Frame-Options headers
* @return self
*/
public function preDispatch()
{
Mage::register('disable_x_frame_options_header', true, true); // third arg: graceful
return parent::preDispatch();
}
