How to fix Refused to display in a frame because it set 'X-Frame-Options' to 'sameorigin

Question

I'm getting an error while using an i-frame in angular. It refused to display in a frame because it set 'X-Frame-Options' to 'sameorigin'

Refused to display 'https://docs.google.com/gview?url=https://subtreebucket.s3.amazonaws.com/docsFile_1559124133664_dummy.pdf' in a frame because it set 'X-Frame-Options' to 'sameorigin'.

Answer 1

You cannot overrule that: as you can see in the response to the GET request for the url you are showing, there is a response header x-frame-options: SAMEORIGIN.

It means that the origin server does not authorize you to show this content inside an iframe.

You cannot circumvent this, this is a security protection: otherwise it would make session hijacking too easy.

The only way to go is to have the same resource with an URL that allows you to be viewed (such as the PDF url directly, here https://subtreebucket.s3.amazonaws.com/docsFile_1559124133664_dummy.pdf, or adding embedded=true to the URL might work, which is google docs specific).