alphagov/manuals-frontend — pull request #123 by jamiecobbett (2014-12-12 13:52:49+00:00)
Title: Enable pages to be used in iframes

Rails 4+ sets the X-Frame-Options header to SAMEORIGIN by default. This means
that the resource can only be put into an iframe on the same domain.

One problem this causes is that the side-by-side browser - which is a tool used
during transition - can't work correctly.

In the past we have decided that, with the exception of transaction start
pages, we want to allow content on GOV.UK to be iframed. Transaction start
pages are exceptional because we are particularly concerned about clickjacking
of the start button.