Refused to display 'XXX' in a frame because it set 'X-Frame-Options' to 'sameorigin'.

Refused to display ‘XXX’ in a frame because it set ‘X-Frame-Options’ to ‘sameorigin’.

今天在学习前后端分离的项目的时候遇到了Refused to display ‘XXX’ in a frame because it set ‘X-Frame-Options’ to ‘deny’.的问题，然后百度一通发现是spring security和iframe安全性的问题

百度上大部分的解决办法是加入在继承WebSecurityConfigurerAdapter的子类的覆盖方法configure(HttpSecurity)里面添加：
http.headers().frameOptions().sameOrigin();

然而我添加了这句代码之后报错变成了Refused to display ‘XXX’ in a frame because it set ‘X-Frame-Options’ to ‘sameorigin’.

最后把http.headers().frameOptions().sameOrigin();改成http.headers().frameOptions().disable();才行，原因未明，记录一下