SEC-2511: Remove double ALLOW-FROM in X-Frame-Options header

web/src/test/java/org/springframework/security/web/header/writers/frameoptions/AbstractRequestParameterAllowFromStrategyTests.java

@@ -73,7 +73,7 @@ public class AbstractRequestParameterAllowFromStrategyTests {
 
         assertThat(
                 strategy
-                        .getAllowFromValue(request)).isEqualTo("ALLOW-FROM "+value);
+                        .getAllowFromValue(request)).isEqualTo(value);
     }
 
     @Test

web/src/test/java/org/springframework/security/web/header/writers/frameoptions/RegExpAllowFromStrategyTests.java

@@ -33,11 +33,11 @@ public class RegExpAllowFromStrategyTests {
 
         request.setParameter("from", "http://abc.test.com");
         String result1 = strategy.getAllowFromValue(request);
-        assertThat(result1, is("ALLOW-FROM http://abc.test.com"));
+        assertThat(result1, is("http://abc.test.com"));
 
         request.setParameter("from", "http://foo.test.com");
         String result2 = strategy.getAllowFromValue(request);
-        assertThat(result2, is("ALLOW-FROM http://foo.test.com"));
+        assertThat(result2, is("http://foo.test.com"));
 
         request.setParameter("from", "http://test.foobar.com");
         String result3 = strategy.getAllowFromValue(request);

web/src/test/java/org/springframework/security/web/header/writers/frameoptions/WhiteListedAllowFromStrategyTests.java

@@ -38,7 +38,7 @@ public class WhiteListedAllowFromStrategyTests {
         request.setParameter("from", "http://www.test.com");
 
         String result = strategy.getAllowFromValue(request);
-        assertThat(result, is("ALLOW-FROM http://www.test.com"));
+        assertThat(result, is("http://www.test.com"));
     }
 
     @Test
@@ -52,7 +52,7 @@ public class WhiteListedAllowFromStrategyTests {
         request.setParameter("from", "http://www.test.com");
 
         String result = strategy.getAllowFromValue(request);
-        assertThat(result, is("ALLOW-FROM http://www.test.com"));
+        assertThat(result, is("http://www.test.com"));
     }
 
     @Test