Does confluence cloud allow changing x-frame-options header ?

[Ajay Upadhyaya]

Does confluence cloud allow changing x-frame-options header ?

Currently its set to SAMEORIGIN, and prevents any confluence page to be embedded in an iframe from a different domain.

[Nic Brough -Adaptavist-]

No.  You need to hack the code (or settings in Tomcat for this one, I think).  

Changes like that are restricted functions, in order to keep the system supportable.

[Ajay Upadhyaya]

I think Confluence Server is not a problem as we get to control the environment. But my question is specifically about Confluence Cloud. I'm looking for a way to change the header to allow from few safe authorized urls, as mentioned in the specs - https://developer.mozilla.org/en-US/docs/Web/HTTP/X-Frame-Options

[Nic Brough -Adaptavist-]

Cloud is what I answered for.

[Ajay Upadhyaya]

Do we have access to Tomcat settings in Confluence Cloud? I mean when I signup for confluence on atlassian.net do we get access to change anything on the server? From Confluence Admin settings I don't see an option to change anything for Tomcat / Java etc.

[Nic Brough -Adaptavist-]

As I already said, changes like that are restricted functions.

You can not change this stuff.

[Ajay Upadhyaya]

Sure Nic, then we are same page, because anything that as a customer I can't change (even can't hack) is essentially considered not possible in my opinion.

I see you have a enhancement ticket opened here - https://jira.atlassian.com/browse/CONF-40640 in which you mention confluence.clickjacking.protection.disable as a way, but unless customer has a way to set this property, essentially there is no way, isn't? I'll +1 on your ticket, as this looks like a very important enhancement request to enable reusing confluence pages by embedding them elsewhere. 

[Nic Brough -Adaptavist-]

Ah, it's not my issue, I'm not an Atlassian, but yes, vote on that to encourage them to enable something.