Turns out these are ASCII case insensitive

Author: domenic

source

@@ -84840,12 +84840,12 @@ interface <dfn>BeforeUnloadEvent</dfn> : <span>Event</span> {
    `<code>X-Frame-Options</code>` from <var>response</var>'s <span
    data-x="concept-response-header-list">header list</span>.</p></li>
 
-   <li><p>If <var>xFrameOptions</var> <span data-x="list contains">contains</span> "<code
-   data-x="">DENY</code>", then return false.</p></li>
+   <li><p>If <var>xFrameOptions</var> <span data-x="list contains">contains</span> an <span>ASCII
+   case-insensitive</span> match for "<code data-x="">deny</code>", then return false.</p></li>
 
    <li>
-    <p>If <var>xFrameOptions</var> <span data-x="list contains">contains</span> "<code
-    data-x="">SAMEORIGIN</code>", then:</p>
+    <p>If <var>xFrameOptions</var> <span data-x="list contains">contains</span> an <span>ASCII
+    case-insensitive</span> match for "<code data-x="">sameorigin</code>", then:</p>
 
     <ol>
      <li><p>Let <var>ancestorBC</var> be <var>browsingContext</var>'s <span>parent browsing