spring-security 關閉「禁止iframe調用」

@Configuration
@EnableWebSecurity
//@EnableGlobalMethodSecurity(prePostEnabled=true)//開啓@PreAuthorize註解
public class WebSecurityConfig extends WebSecurityConfigurerAdapter {
	
	@Override
    protected void configure(HttpSecurity http) throws Exception {
    	/** 
         * 自定義HeaderWriter，用以覆蓋security默認的Header, 
         * 使默認的"X-Frame-Options：DENY"禁止一切iframe調用 
         * 轉化爲"X-Frame-Options：SAMEORIGIN"容許同域下的iframe調用 
         */  
        HeaderWriter headerWriter = new HeaderWriter() {
            @Override  
            public void writeHeaders(HttpServletRequest request, HttpServletResponse response) {
                response.setHeader("X-Frame-Options","SAMEORIGIN");  
            }  
        };  
        List<HeaderWriter> headerWriters = new ArrayList<>();
        headerWriters.add(headerWriter);  
        HeaderWriterFilter headerWriterFilter = new HeaderWriterFilter(headerWriters);  
        http.addFilter(headerWriterFilter);

    }

}