title: Apache X-Frame-Options conflict for IE and Chrome (only either one worked!)
body: <p>I have a site that I need to load resources from itself as well as from another URL.</p>
  
  <p>Therefore, in Apache, I added both the SAMEORIGIN and the ALLOW-FROM.</p>
  
  <p>Interestingly, Chrome refused to show the page, stating that there is multiple X-Frame-Options headers with conflicting values, and falling back to 'deny'. On the other hand, IE works fine!</p>
  
  <p>I modified it by removing the SAMEORIGIN and added my the originating site URL into the ALLOW-FROM. This time, Chrome works, but IE does not!</p>
  
  <p>In case you wanted to try, these are the settings that I used that experience the issue:</p>
  
  <pre><code># Test 1: Use these 2 lines will make IE work, but not Chrome
  Header always append X-Frame-Options "SAMEORIGIN"
  Header always append X-Frame-Options "ALLOW-FROM https://www.google.com"
  
  # Test 2: Use these 2 lines will make Chrome work, but not IE 
  # (&lt;MyBaseServerURL&gt; represents the location as indicated by the "SAMEORIGIN")
  Header always append X-Frame-Options "ALLOW-FROM https://www.google.com"
  Header always append X-Frame-Options "ALLOW-FROM https://&lt;MyBaseServerURL&gt;"
  </code></pre>
  
  <p>Could someone advise how I could resolve this?</p>
  
  <p>Thanks and regards,
  Jacky</p>