Unable to load livechat since updating to 3.3.0 due to X-Frame-Options: sameorigin

Description:

Today I updated my server from 2.9.x to 3.3.0. After finishing the upgrade, I navigated to one of the websites which utilizes the Live Chat (now Omnichat) integration, only to find a grey square (of an iframe which didn't load) where the Live Chat button should have been. I looked in the console and found an error caused by the X-Frame-Options: sameorigin header.

I tried specifically adding the hostname of the website(s) which utilize the Livechat, but that did not make any difference. I confirmed that the issue was caused by Rocket Chat and not by an intermediary by running a curl request directly from the server:

curl -v http://localhost:3000/livechat

Which responded with:

*   Trying 127.0.0.1...
* TCP_NODELAY set
* Connected to localhost (127.0.0.1) port 3000 (#0)
> GET /livechat HTTP/1.1
> Host: localhost:3000
> User-Agent: curl/7.58.0
> Accept: */*
> 
< HTTP/1.1 200 OK
< X-XSS-Protection: 1
< X-Frame-Options: sameorigin
< X-Instance-ID: mpXqru2q2qES9pnw7
< content-type: text/html; charset=utf-8
< Vary: Accept-Encoding
< Date: Fri, 29 May 2020 20:03:59 GMT
< Connection: keep-alive
< Transfer-Encoding: chunked

Note: I have been able to mitigate the issue through the use of Cloudflare's Workers, which allows me to remove the header. This does resolve the issue, however I would prefer to not have to pay the $5/month to ensure that my self-hosted livechat is working correctly.

Steps to reproduce:

1. From the machine hosting Rocket Chat, make a verbose curl request:

curl -v http://localhost:3000/livechat

Expected behavior:

If there are domains configured, then the X-Frame-Options should reflect those domains. Otherwise it should not be present

Actual behavior:

X-Frame-Options: sameorigin is returned

Server Setup Information:

• Version of Rocket.Chat Server: 3.3.0
• Operating System: Linux
• Deployment Method: DigitalOcean
• Number of Running Instances: 1
• DB Replicaset Oplog: Enabled
• NodeJS Version: v12.16.1
• MongoDB Version:

Start at the /livechat endpoint and reproduce the response with the verbose curl command shown in the issue. Verify the X-Frame-Options behavior for configured and unconfigured domains; done means the header reflects allowed domains or is absent when none are configured.