initial commit of new Drupal module designed to allow H5P embedding on external sites

README.oeru

+This fix should allow embedding H5P objects from this site on other sites, like our course and WPMS WordPress multisites.
+
+Sources: 
+https://drupal.stackexchange.com/questions/188924/how-to-embed-drupal-content-in-other-sites-remove-x-frame-options-sameorigin/201297#201297
+https://www.drupal.org/project/h5p/issues/2612208#comment-12476851
+
+Dave (dave@oerfoundation.org 20200616)

allow_h5p_embed.info.yml

+name: Allow H5P Object embedding
+description: For a Drupal8 site offering a library of H5P (https://h5p.org) learning objects for external embedding, we need to override Drupal8's default X-Frame-Options header setting of "SAMEORIGIN" which prohibits embedding content. So, only in the case of H5P objects, which have a path starting with /h5p/[ID]/embed, we remove that header.
+package: OERu Custom
+type: module
+core: 8.x
+dependencies:

allow_h5p_embed.services.yml

+services:
+  remove_x_frame_options_subscriber:
+    class: Drupal\mymodule\EventSubscriber\RemoveXFrameOptionsSubscriber
+    tags:
+      - { name: event_subscriber }

src/EventSubscriber/RemoveXFrameOptionsSubscriber.php

+<?php
+
+namespace Drupal\mymodule\EventSubscriber;
+
+use Symfony\Component\EventDispatcher\EventSubscriberInterface;
+use Symfony\Component\HttpKernel\Event\FilterResponseEvent;
+use Symfony\Component\HttpKernel\KernelEvents;
+
+class RemoveXFrameOptionsSubscriber implements EventSubscriberInterface {
+
+  public function RemoveXFrameOptions(FilterResponseEvent $event) {
+    $response = $event->getResponse();
+
+    if (preg_match('/^\/h5p\/[0-9]+\/embed$/', $event->getRequest()->getPathInfo())) {
+      $response->headers->remove('X-Frame-Options');
+    }
+  }
+
+  public static function getSubscribedEvents() {
+    $events[KernelEvents::RESPONSE][] = array('RemoveXFrameOptions', -10);
+    return $events;
+  }
+}