Setting the X-Frame-Options header, and other headers more generally

[hoelzro]

I run TiddlyWiki using Node, and a while ago when I was on a tutorial page for some software (https://concourse-ci.org, IIRC), I was surprised that when it used an iframe to show a working setup (which was meant to be listening on port 8080), it showed my wiki instead! This freaked me out a bit, but I worked around it with uBlock Origin and moved on.

But I was thinking about this again recently, and I was wondering if TiddlyWiki on Node should be setting X-Frame-Options. I was also wondering if this might be better served as a plugin, but AFAICT there's no sanctioned way to set headers under Node - would it make sense to have a sort of "server middleware" hook to do this kind of thing?