Yep, [default is sameorigin](https://github.com/rkh/rack-protection/blob/master/lib/rack/protection/frame_options.rb#L20).

What's your problem?