Multiple X-Frame-Options headers conflict in browser by nginx - nginx

Question

I am trying to get a remote web page into an iframe in my project. When i try to open my project web site the browser console displays below error and not showing page in iframe.
Nginx Refused to display 'http://www.xxxxx.com/' in a frame because it set multiple 'X-Frame-Options' headers with conflicting values ('DENY, ALLOW-FROM http://www........com'). Falling back to 'deny'.
I also added below line in nginx xconf:
add_header X-Frame-Options "ALLOW-FROM http://www.......com";
There is no X-Frame-Options = Deny configuration in any place in my Nginx configurations.
But still, when I run the page it shows multiple headers. It is like Deny is hardcoded default. But I just added 1 header (ALLOW-FROM).
Where does the other header (DENY) come from, I don't understand. How can I bypass this deny header which is coming with the response page when I insert it into the iframe?
I also used Chrome Extension Requestly that can be used to add/remove/modify response headers. It works when I use the Requestly extension on my machine.
But I can't use a chrome extension-based solution as the site is public and everyone does not use Requestly. So I am looking for an Nginx-config based solution or any server-side solution to remove this header.

Answer 1

I solved this problem in Django settings, commenting some middleware lines and adding some variables. 178.62.107.96 is the server in which we create iframe and insert django server created web page :
MIDDLEWARE = [
'django.middleware.security.SecurityMiddleware',
'django.contrib.sessions.middleware.SessionMiddleware',
'django.middleware.common.CommonMiddleware',
#'django.middleware.csrf.CsrfViewMiddleware',
'django.contrib.auth.middleware.AuthenticationMiddleware',
'django.contrib.messages.middleware.MessageMiddleware',
#'django.middleware.clickjacking.XFrameOptionsMiddleware',
]
X_FRAME_OPTIONS = 'ALLOW-FROM 178.62.*.*'
CSRF_TRUSTED_ORIGINS = ['178.62.*.*']
CSRF_COOKIE_SAMESITE = None