Hacker News Reader

IIRC the [responsible org] says we don't have to add the `X-` to custom headers anymore.

Edit: IETF and IANA are the orgs

RFC 4229 https://www.rfc-editor.org/rfc/rfc4229.html

This is not a custom header (i.e. one with no UA semantics), it is a standardized header called X-Frame-Options which requires the “X-“ for browsers to recognize it. The prefix is an artifact of the era the header was introduced in.

https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-...

It's also been deprecated in favor of the content-security-policy header.

Was curious what they say about it but the link didn't seem to have anything on custom headers.

Reply on news.ycombinator.com