Proof of concept of ignoring x-frame-options for sign-in webui.

chrome/browser/ui/webui/signin/signin_ui.cc

+// Copyright 2014 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "chrome/browser/ui/webui/signin/signin_ui.h"
+
+#include <string>
+
+#include "base/bind.h"
+#include "base/memory/ref_counted_memory.h"
+#include "base/memory/scoped_ptr.h"
+#include "base/strings/string_util.h"
+#include "base/strings/stringprintf.h"
+#include "chrome/browser/net/chrome_url_request_context.h"
+#include "chrome/browser/profiles/profile.h"
+#include "chrome/common/url_constants.h"
+#include "content/public/browser/browser_thread.h"
+#include "content/public/browser/web_contents.h"
+#include "content/public/browser/web_ui.h"
+#include "content/public/browser/web_ui_data_source.h"
+#include "grit/browser_resources.h"
+#include "net/url_request/url_fetcher.h"
+#include "net/url_request/url_fetcher_delegate.h"
+#include "net/url_request/url_request_context_getter.h"
+#include "ui/base/resource/resource_bundle.h"
+
+using content::BrowserThread;
+using content::WebContents;
+
+namespace {
+
+content::WebUIDataSource* CreateWebUIDataSource() {
+  content::WebUIDataSource* source =
+        content::WebUIDataSource::Create(chrome::kChromeSigninHost);
+  source->DisableContentSecurityPolicy();  // So we can add iframe.
+  source->SetUseJsonJSFormatV2();
+  source->SetJsonPath("strings.js");
+
+  source->SetDefaultResource(IDR_SIGNIN_HTML);
+  return source;
+};
+
+} // empty namespace
+
+SigninUI::SigninUI(content::WebUI* web_ui) : WebUIController(web_ui) {
+  Profile* profile = Profile::FromWebUI(web_ui);
+  content::WebUIDataSource::Add(profile, CreateWebUIDataSource());
+}