@Override protected void configure(HttpSecurity http) throws Exception { ... http.headers().frameOptions().disable(); ... }