@Test
  public void testXFrameHeaderSameOrigin() throws Exception {
    Configuration conf = new Configuration();
    conf.set("hbase.http.filter.xframeoptions.mode", "SAMEORIGIN");

    HttpServer myServer = new HttpServer.Builder().setName("test")
      .addEndpoint(new URI("http://localhost:0")).setFindPort(true).setConf(conf).build();
    myServer.setAttribute(HttpServer.CONF_CONTEXT_ATTRIBUTE, conf);
    myServer.addUnprivilegedServlet("echo", "/echo", EchoServlet.class);
    myServer.start();

    String serverURL = "http://" + NetUtils.getHostPortString(myServer.getConnectorAddress(0));
    URL url = new URL(new URL(serverURL), "/echo?a=b&c=d");
    HttpURLConnection conn = (HttpURLConnection) url.openConnection();
    assertEquals(HttpURLConnection.HTTP_OK, conn.getResponseCode());
    assertEquals("SAMEORIGIN", conn.getHeaderField("X-Frame-Options"));
    myServer.stop();
  }
Verify the administrator access for /logs, /stacks, /conf, /logLevel and /metrics servlets.
hbase-http/src/test/java/org/apache/hadoop/hbase/http/TestHttpServer.java