title: How to allow X_FRAME_OPTIONS for Facebook in Django app
body: <p>in my Django <code>settings.py</code> file I have</p>
  
  <pre><code>MIDDLEWARE_CLASSES = (
    ....
    'django.middleware.clickjacking.XFrameOptionsMiddleware',
  )
  </code></pre>
  
  <p>and</p>
  
  <pre><code>X_FRAME_OPTIONS = 'ALLOW-FROM https://apps.facebook.com/'
  </code></pre>
  
  <p>This is because I want my app to be displayed in Facebook canvas, but it isn't working as I keep on getting</p>
  
  <pre><code>Refused to display 'https://www.facebook.com/dialog/oauth?scope=email%2Cpublish_actions&amp;state=7…edirect_state%3D7EdHoAcZYlnIaURuz1YI8sbRhxhBg2iM&amp;client_id=420498651348242' in a frame because it set 'X-Frame-Options' to 'DENY'.
  </code></pre>
  
  <p>What am I doing wrong?</p>
  
  <p><strong>PD:</strong></p>
  
  <p>I need framing to use <code>{% url 'django.contrib.auth.views.login' %}</code> <strong>after login into Facebook</strong></p>
  
  <p><strong>--> EDIT:</strong></p>
  
  <p>Explanation of what I need: I want my app to work in Facebook Canvas, after login into Facebook successfully, I need to make a redirection (call the Django auth login url).</p>
  
  <p>When doing this, I get</p>
  
  <pre><code>Refused to display 'https://www.facebook.com/dialog/oauth?scope=email%2Cpublish_actions&amp;state=7…edirect_state%3D7EdHoAcZYlnIaURuz1YI8sbRhxhBg2iM&amp;client_id=420498651348242' in a frame because it set 'X-Frame-Options' to 'DENY'.
  </code></pre>
  
  <p>So I tried channging <code>X_FRAME_OPTIONS</code> in my `settings.py', when doing</p>
  
  <pre><code>X_FRAME_OPTIONS = 'SAMEORIGIN'
  </code></pre>
  
  <p>The error changed to say that <code>X-Frame-Options</code> was <code>SAMEORIGIN</code> instead of <code>DENY</code>.</p>
  
  <p>This is why I asked on how I could make X-Frame-Options to allow framing in Facebook, so I could get my app to work in Facebook Canvas.</p>
  
  <p>Sorry for bad explaining. If yet not explained correctly, please ask for more details.</p>