StreamResource with X-Frame-Options...

                    // Create new StreamResource from File.
                    StreamResource resourceIO = new StreamResource("Invoice_" + invoiceIO.getId() + ".pdf", () -> {
                        try {
                            return new ByteArrayInputStream(FileUtils.readFileToByteArray(fileIO));
                        } catch (IOException e) {
                            throw new RuntimeException(e);

                    // Set Mime Type.
                    resourceIO.setHeader("X-Frame-Options", "SAMEORIGIN");

HTTP/1.1 200
Cache-Control: max-age=60
Expires: Sat, 02 Dec 2023 14:00:08 GMT
Pragma: cache
**X-Frame-Options: DENY**
X-Content-Type-Options: nosniff
X-XSS-Protection: 0
Content-Type: application/pdf
Content-Length: 1055
Date: Sat, 02 Dec 2023 13:59:08 GMT
Keep-Alive: timeout=60
Connection: keep-alive

How to set that X-Frame-Options Header?

You are probably using spring (boot) - there you have to do it in your security configuration. http.headers()

Yea i using JMIX Framework which is build on top of VAADIN :I And depends on Spring…