docs/daprdocs/staticwebapp.config.json

{
    "globalHeaders": {
      "X-Frame-Options": "DENY"
    }
}