allowed overwriting the default file serve headers if an explicit response header is set

apis/file.go

@@ -92,6 +92,11 @@ func (api *fileApi) download(c echo.Context) error {
 	event.ServedPath = servedPath
 	event.ServedName = servedName
 
+	// clickjacking shouldn't be a concern when serving uploaded files,
+	// so it safe to unset the global X-Frame-Options to allow files embedding
+	// (note: it is out of the hook to allow users to customize the behavior)
+	c.Response().Header().Del("X-Frame-Options")
+
 	return api.app.OnFileDownloadRequest().Trigger(event, func(e *core.FileDownloadEvent) error {
 		res := e.HttpContext.Response()
 		req := e.HttpContext.Request()