Django 3+ debug error views don't set X-Frame-Options so aren't displayed in the iframe

[bcdickinson]

Issue Summary

We set X-Frame-Options: sameorigin on RenderPatternView responses, but if an exception is raised and DEBUG = True, the error page response does not have that header set by default.

Steps to Reproduce

1. Try to view a pattern that throws an error while rendering (or stick assert False in the RenderPatternView.get() method)
2. Django debug error page is blocked by browser:

Possible solution

I think the solution here is probably a documentation fix saying you'll need to set X_FRAME_OPTIONS = 'SAMEORIGIN' in your development settings (unless your project is already being at least that permissive).

[allcaps]

Yep, this might be it.

[thibaudcolas]

For @bcdickinson to:

• Document in our docs
• Report to Django for consideration (not necessarily a bug but feels like unexpected behavior)