title: How does .headers().frameOptions().disable() work?
body: <p>About <code>Spring Security</code> to let, control and get access to the <code>h2</code> web console</p>
  <p>I read these two posts:</p>
  <ul>
  <li><a href="https://stackoverflow.com/questions/43794721/spring-boot-h2-console-throws-403-with-spring-security-1-5-2">Spring Boot /h2-console throws 403 with Spring Security 1.5.2</a></li>
  <li><a href="https://stackoverflow.com/questions/41961270/h2-console-and-spring-security-permitall-not-working">H2 console and Spring Security - permitAll() not working</a></li>
  </ul>
  <p>In conclusion is mandatory use the following (&quot;improved&quot; in someway):</p>
  <pre><code>@Override
  protected void configure(HttpSecurity http) throws Exception {
      http
          .authorizeRequests()
              .mvcMatchers(&quot;/admin/**&quot;).hasRole(&quot;ADMIN&quot;)
              ...
              .mvcMatchers(&quot;/h2-console/**&quot;).hasRole(&quot;ADMIN&quot;)
              .and()
          .csrf().ignoringAntMatchers(&quot;/h2-console/**&quot;)
              .and()
          .headers().frameOptions().disable()
              .and()
  </code></pre>
  <p>From above is better use <code>.csrf().ignoringAntMatchers(&quot;/h2-console/**&quot;)</code> instead of <code>csrf().disable()</code> it for security reasons because the disable point applies only to <code>/h2-console/</code>, the latter is global and is not recommended.</p>
  <p>Until here I am fine. And I am able to see the
  H2 web console once the login process happened and the user has the required role.</p>
  <p><a href="https://i.stack.imgur.com/CjNlQ.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/CjNlQ.png" alt="enter image description here" /></a></p>
  <p>Now is mandatory use <code>.headers().frameOptions().disable()</code>, if is not used happens the following:</p>
  <p><a href="https://i.stack.imgur.com/knnWQ.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/knnWQ.png" alt="enter image description here" /></a></p>
  <p>The <code>localhost refused to connect</code> message appears to any inner block when the mouse's cursor is over any of them</p>
  <p>My doubts are:</p>
  <ol>
  <li>How does <code>.headers().frameOptions().disable()</code> work?</li>
  <li>Is safe to use that sentence for Production Environment? Consider the difference between
  <code>.csrf().ignoringAntMatchers(&quot;/h2-console/**&quot;)</code> and <code>csrf().disable()</code>, where the former is specific and the latter is &quot;global&quot; (and is not recommended). Therefore perhaps would be available a specific configuration much better than <code>.headers().frameOptions().disable()</code> (at a first glance for me is a &quot;global&quot; configuration) to only apply to <code>/h2-console/</code></li>
  <li>Could <code>.headers().frameOptions().disable()</code> have any negative effect, directly or indirectly, for other <code>configure(HttpSecurity http)</code> configuration? (Mostly for Production)</li>
  </ol>