GeoServer styles AJAX requests are blocked due to X-FRAME-OPTIONS

Question

I am running GeoServer behind a Nginx proxy with an SSL cert. Everything is working well (that I can tell so far) with the exception of editing layer styles.

Performing any action that involves AJAX requests on that page results in the requests being blocked due to X-FRAME-OPTIONS.

Refused to display 'https://myserver.com/geoserver/web/wicket/bookmarkable/org.geoserver.wms.web.data.StyleEditPage?10-1.IBehaviorListener.0-styleForm-context-tabs~container-tabs-1-link&name=State+Boundaries&wicket-ajax=true&wicket-ajax-baseurl=wicket%2Fbookmarkable%2Forg.geoserver.wms.web.data.StyleEditPage%3F10%26amp%3Bname%3DState%2BBoundaries'
in a frame because it set 'X-Frame-Options' to 'DENY'.

I have disabled all X-FRAME-OPTIONS that I could find, and from what I was reading, GeoServer should default to SAMEORIGIN. Any attempts I made at overriding the policy in /webapps/geoserver/WEB-INF/web.xml prevented GeoServer from even starting up.

If I add my X-FRAME-OPTIONS declaration in Nginx back in, it also gets denies, saying there were multiple options set, an it fell back to DENY.

I'm quite certain this has to do with the Nginx proxy (since GeoServer runs just fine without it):

location / {
    proxy_pass http://127.0.0.1:8080/geoserver/;
    proxy_pass_header Set-Cookie;
    proxy_set_header Host $host;
    proxy_set_header X-Forwarded-Proto $scheme;
    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
}

location /geoserver/ {
    proxy_pass http://127.0.0.1:8080/geoserver/;
    proxy_pass_header Set-Cookie;
    proxy_set_header Host $host;
    proxy_set_header X-Forwarded-Proto $scheme;
    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
}

Is there anything I'm missing there?

Answer 1

Digging deeper, I was able to find another file on my system that was adding the DENY option, using the following command:

sudo grep -ri "X-Frame-Options" /

Once I made the appropriate edits to those Nginx config files, everything worked great.

In short, the issue was due to cascading config files, and me not realizing there were additional config files being loaded by Nginx.