Automatically remove security headers that prevent services from being embedded into an iframe

While working on a Vault playground, I noticed the browser cannot serve the UI through a tab (http port).

Adding a reverse proxy in front of the service and removing the following headers solved the problem:

• X-Frame-Options
• Content-Security-Policy

There is probably a better solution than flat-out removing those headers, but I didn't do enough research.