title: How to "allow-from" more than one domain for "X-Frame-Options" in Rails 4 controller?
body: <p>In a Ruby on Rails 4 application I'm working on, I need to make a page that will be pulled into an iframe hosted on the <code>foo.bar.com</code> server, so I have this controller method:</p>
  
  <pre><code>def iframed_page
    response.headers["X-FRAME-OPTIONS"] = "ALLOW-FROM http://foo.bar.com"
  end
  </code></pre>
  
  <p>..and now it turns out that the client wants me to also whitelist <code>http://foo.dev.bar.com</code> as well.</p>
  
  <p>I know that for setting X-FRAME-OPTIONS, the "ALLOW-FROM" option doesn't allow for multiple subdomains.  But since this is the same root domain with different subdomains, would it be a little more flexible?  For example, could I do something like </p>
  
  <pre><code>response.headers["X-FRAME-OPTIONS"] = "ALLOW-FROM http://*.bar.com"
  </code></pre>
  
  <p>as well?</p>