Gitpod: [theia] Browser Widget isn't loading examples

[AlexTugarev]

for instance, the django example is failing to be shown in the preview browser to the side:

and in the referer-policy for the relevant resources seems to be different in comparison to PROD.

[svenefftinge]

The X-Frame-Options is sent to sameorigin. That header should be filtered by the proxy but is not.

[geropl]

The X-Frame-Options is sent to sameorigin. That header should be filtered by the proxy but is not.

1. We deploy staging - and in the near future prod - with ws-proxy. In this case nginx forwards workspace-specific traffic via these lines (not the ones linked above). If we wanted to (re-)add the filter it's worth thinking about whether w want to add it to ws-proxy instead. If that's helpful we have to think through all deployment scenarios.

2. I don't recall atm, but there were multiple factors that would allow/deny access iframes. I'm not 100% sure that X-Frame-Options is the reason in this case: @AlexTugarev can you check whether the header is actually sent (scrolling down in the first screenshot?)

[svenefftinge]

Yes, the X-Frame-Options header is the reason. And since we filtered it out in the past (in prod) we will break some use cases if we don't continue doing that. Some dev servers (e.g. django example) send this header by default because they want to be "secure by default". I think we should keep filtering that.